Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
21/04/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe
-
Size
530KB
-
MD5
4d577363965ec8f79bdecab22338ffbd
-
SHA1
05828a8734e3fe83b8c28e8ddc2a7e0942abdd55
-
SHA256
4aa871997d6c0721b2f1158dcd65aef536c0d349e39d7e4c1eecefe5ddbdedab
-
SHA512
c1653d4e6afc166e656ca0ef759d516805822a6dea01af8e59c703c8b47ea5f363bcc21a21a323d9b2a83c97324bfa66dd3aa3c1dc65d352fb159931cb36c3b7
-
SSDEEP
12288:AU5rCOTeior4g078vk9cVr+bZeAWZPfQLIHNZulFVg0M1:AUQOJoriYtEVNUfYIHNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4140 8D95.tmp 4868 8E02.tmp 3904 8E60.tmp 824 8ECE.tmp 852 8F4B.tmp 3252 8FA8.tmp 3256 8FF6.tmp 4472 9045.tmp 3476 90A2.tmp 2232 90F0.tmp 116 915E.tmp 1692 91AC.tmp 3208 920A.tmp 2244 9267.tmp 4928 92D5.tmp 4584 9342.tmp 2676 93A0.tmp 4808 93EE.tmp 1400 945B.tmp 1668 94E8.tmp 4228 9555.tmp 3752 95B3.tmp 1428 9601.tmp 2196 965F.tmp 2188 96AD.tmp 1212 970B.tmp 2072 9778.tmp 3260 97E6.tmp 2264 9843.tmp 3012 98A1.tmp 4952 990F.tmp 3020 997C.tmp 464 99CA.tmp 3392 9A18.tmp 3696 9A66.tmp 932 9AB4.tmp 5072 9B12.tmp 4140 9B60.tmp 3984 9BAE.tmp 3124 9C0C.tmp 2172 9C6A.tmp 3676 9CB8.tmp 4812 9D06.tmp 3904 9D54.tmp 376 9DB2.tmp 4640 9E00.tmp 852 9E4E.tmp 3588 9E9C.tmp 4976 9EEB.tmp 3528 9F39.tmp 796 9F87.tmp 4920 9FD5.tmp 3480 A023.tmp 3740 A071.tmp 4080 A0BF.tmp 1492 A10D.tmp 2024 A15C.tmp 452 A1AA.tmp 2704 A1F8.tmp 1296 A246.tmp 3924 A294.tmp 2148 A2E2.tmp 4928 A340.tmp 3624 A39E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 4140 1096 2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe 85 PID 1096 wrote to memory of 4140 1096 2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe 85 PID 1096 wrote to memory of 4140 1096 2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe 85 PID 4140 wrote to memory of 4868 4140 8D95.tmp 86 PID 4140 wrote to memory of 4868 4140 8D95.tmp 86 PID 4140 wrote to memory of 4868 4140 8D95.tmp 86 PID 4868 wrote to memory of 3904 4868 8E02.tmp 87 PID 4868 wrote to memory of 3904 4868 8E02.tmp 87 PID 4868 wrote to memory of 3904 4868 8E02.tmp 87 PID 3904 wrote to memory of 824 3904 8E60.tmp 88 PID 3904 wrote to memory of 824 3904 8E60.tmp 88 PID 3904 wrote to memory of 824 3904 8E60.tmp 88 PID 824 wrote to memory of 852 824 8ECE.tmp 89 PID 824 wrote to memory of 852 824 8ECE.tmp 89 PID 824 wrote to memory of 852 824 8ECE.tmp 89 PID 852 wrote to memory of 3252 852 8F4B.tmp 90 PID 852 wrote to memory of 3252 852 8F4B.tmp 90 PID 852 wrote to memory of 3252 852 8F4B.tmp 90 PID 3252 wrote to memory of 3256 3252 8FA8.tmp 93 PID 3252 wrote to memory of 3256 3252 8FA8.tmp 93 PID 3252 wrote to memory of 3256 3252 8FA8.tmp 93 PID 3256 wrote to memory of 4472 3256 8FF6.tmp 94 PID 3256 wrote to memory of 4472 3256 8FF6.tmp 94 PID 3256 wrote to memory of 4472 3256 8FF6.tmp 94 PID 4472 wrote to memory of 3476 4472 9045.tmp 96 PID 4472 wrote to memory of 3476 4472 9045.tmp 96 PID 4472 wrote to memory of 3476 4472 9045.tmp 96 PID 3476 wrote to memory of 2232 3476 90A2.tmp 97 PID 3476 wrote to memory of 2232 3476 90A2.tmp 97 PID 3476 wrote to memory of 2232 3476 90A2.tmp 97 PID 2232 wrote to memory of 116 2232 90F0.tmp 98 PID 2232 wrote to memory of 116 2232 90F0.tmp 98 PID 2232 wrote to memory of 116 2232 90F0.tmp 98 PID 116 wrote to memory of 1692 116 915E.tmp 99 PID 116 wrote to memory of 1692 116 915E.tmp 99 PID 116 wrote to memory of 1692 116 915E.tmp 99 PID 1692 wrote to memory of 3208 1692 91AC.tmp 100 PID 1692 wrote to memory of 3208 1692 91AC.tmp 100 PID 1692 wrote to memory of 3208 1692 91AC.tmp 100 PID 3208 wrote to memory of 2244 3208 920A.tmp 101 PID 3208 wrote to memory of 2244 3208 920A.tmp 101 PID 3208 wrote to memory of 2244 3208 920A.tmp 101 PID 2244 wrote to memory of 4928 2244 9267.tmp 102 PID 2244 wrote to memory of 4928 2244 9267.tmp 102 PID 2244 wrote to memory of 4928 2244 9267.tmp 102 PID 4928 wrote to memory of 4584 4928 92D5.tmp 103 PID 4928 wrote to memory of 4584 4928 92D5.tmp 103 PID 4928 wrote to memory of 4584 4928 92D5.tmp 103 PID 4584 wrote to memory of 2676 4584 9342.tmp 104 PID 4584 wrote to memory of 2676 4584 9342.tmp 104 PID 4584 wrote to memory of 2676 4584 9342.tmp 104 PID 2676 wrote to memory of 4808 2676 93A0.tmp 105 PID 2676 wrote to memory of 4808 2676 93A0.tmp 105 PID 2676 wrote to memory of 4808 2676 93A0.tmp 105 PID 4808 wrote to memory of 1400 4808 93EE.tmp 106 PID 4808 wrote to memory of 1400 4808 93EE.tmp 106 PID 4808 wrote to memory of 1400 4808 93EE.tmp 106 PID 1400 wrote to memory of 1668 1400 945B.tmp 107 PID 1400 wrote to memory of 1668 1400 945B.tmp 107 PID 1400 wrote to memory of 1668 1400 945B.tmp 107 PID 1668 wrote to memory of 4228 1668 94E8.tmp 108 PID 1668 wrote to memory of 4228 1668 94E8.tmp 108 PID 1668 wrote to memory of 4228 1668 94E8.tmp 108 PID 4228 wrote to memory of 3752 4228 9555.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-21_4d577363965ec8f79bdecab22338ffbd_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\8D95.tmp"C:\Users\Admin\AppData\Local\Temp\8D95.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\8E02.tmp"C:\Users\Admin\AppData\Local\Temp\8E02.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\8E60.tmp"C:\Users\Admin\AppData\Local\Temp\8E60.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"C:\Users\Admin\AppData\Local\Temp\8ECE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"C:\Users\Admin\AppData\Local\Temp\8F4B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"C:\Users\Admin\AppData\Local\Temp\8FA8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"C:\Users\Admin\AppData\Local\Temp\8FF6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\9045.tmp"C:\Users\Admin\AppData\Local\Temp\9045.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\90A2.tmp"C:\Users\Admin\AppData\Local\Temp\90A2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\90F0.tmp"C:\Users\Admin\AppData\Local\Temp\90F0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\915E.tmp"C:\Users\Admin\AppData\Local\Temp\915E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\91AC.tmp"C:\Users\Admin\AppData\Local\Temp\91AC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\920A.tmp"C:\Users\Admin\AppData\Local\Temp\920A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\9267.tmp"C:\Users\Admin\AppData\Local\Temp\9267.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\92D5.tmp"C:\Users\Admin\AppData\Local\Temp\92D5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\9342.tmp"C:\Users\Admin\AppData\Local\Temp\9342.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\93A0.tmp"C:\Users\Admin\AppData\Local\Temp\93A0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\93EE.tmp"C:\Users\Admin\AppData\Local\Temp\93EE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\945B.tmp"C:\Users\Admin\AppData\Local\Temp\945B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\94E8.tmp"C:\Users\Admin\AppData\Local\Temp\94E8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\9555.tmp"C:\Users\Admin\AppData\Local\Temp\9555.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\95B3.tmp"C:\Users\Admin\AppData\Local\Temp\95B3.tmp"23⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\9601.tmp"C:\Users\Admin\AppData\Local\Temp\9601.tmp"24⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\965F.tmp"C:\Users\Admin\AppData\Local\Temp\965F.tmp"25⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\96AD.tmp"C:\Users\Admin\AppData\Local\Temp\96AD.tmp"26⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\970B.tmp"C:\Users\Admin\AppData\Local\Temp\970B.tmp"27⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\9778.tmp"C:\Users\Admin\AppData\Local\Temp\9778.tmp"28⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\97E6.tmp"C:\Users\Admin\AppData\Local\Temp\97E6.tmp"29⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\9843.tmp"C:\Users\Admin\AppData\Local\Temp\9843.tmp"30⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\98A1.tmp"C:\Users\Admin\AppData\Local\Temp\98A1.tmp"31⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\990F.tmp"C:\Users\Admin\AppData\Local\Temp\990F.tmp"32⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\997C.tmp"C:\Users\Admin\AppData\Local\Temp\997C.tmp"33⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\99CA.tmp"C:\Users\Admin\AppData\Local\Temp\99CA.tmp"34⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\9A18.tmp"C:\Users\Admin\AppData\Local\Temp\9A18.tmp"35⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\9A66.tmp"C:\Users\Admin\AppData\Local\Temp\9A66.tmp"36⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"37⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\9B12.tmp"C:\Users\Admin\AppData\Local\Temp\9B12.tmp"38⤵
- Executes dropped EXE
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\9B60.tmp"C:\Users\Admin\AppData\Local\Temp\9B60.tmp"39⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"C:\Users\Admin\AppData\Local\Temp\9BAE.tmp"40⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"41⤵
- Executes dropped EXE
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"C:\Users\Admin\AppData\Local\Temp\9C6A.tmp"42⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"C:\Users\Admin\AppData\Local\Temp\9CB8.tmp"43⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\9D06.tmp"C:\Users\Admin\AppData\Local\Temp\9D06.tmp"44⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\9D54.tmp"C:\Users\Admin\AppData\Local\Temp\9D54.tmp"45⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"C:\Users\Admin\AppData\Local\Temp\9DB2.tmp"46⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\9E00.tmp"C:\Users\Admin\AppData\Local\Temp\9E00.tmp"47⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"C:\Users\Admin\AppData\Local\Temp\9E4E.tmp"48⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"C:\Users\Admin\AppData\Local\Temp\9E9C.tmp"49⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"C:\Users\Admin\AppData\Local\Temp\9EEB.tmp"50⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9F39.tmp"C:\Users\Admin\AppData\Local\Temp\9F39.tmp"51⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\9F87.tmp"C:\Users\Admin\AppData\Local\Temp\9F87.tmp"52⤵
- Executes dropped EXE
PID:796 -
C:\Users\Admin\AppData\Local\Temp\9FD5.tmp"C:\Users\Admin\AppData\Local\Temp\9FD5.tmp"53⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\A023.tmp"C:\Users\Admin\AppData\Local\Temp\A023.tmp"54⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\A071.tmp"C:\Users\Admin\AppData\Local\Temp\A071.tmp"55⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"C:\Users\Admin\AppData\Local\Temp\A0BF.tmp"56⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\A10D.tmp"C:\Users\Admin\AppData\Local\Temp\A10D.tmp"57⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\A15C.tmp"C:\Users\Admin\AppData\Local\Temp\A15C.tmp"58⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"C:\Users\Admin\AppData\Local\Temp\A1AA.tmp"59⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"C:\Users\Admin\AppData\Local\Temp\A1F8.tmp"60⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\A246.tmp"C:\Users\Admin\AppData\Local\Temp\A246.tmp"61⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\A294.tmp"C:\Users\Admin\AppData\Local\Temp\A294.tmp"62⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"63⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\A340.tmp"C:\Users\Admin\AppData\Local\Temp\A340.tmp"64⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\A39E.tmp"C:\Users\Admin\AppData\Local\Temp\A39E.tmp"65⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"C:\Users\Admin\AppData\Local\Temp\A3FB.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\A459.tmp"C:\Users\Admin\AppData\Local\Temp\A459.tmp"67⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"C:\Users\Admin\AppData\Local\Temp\A4A7.tmp"68⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\A505.tmp"C:\Users\Admin\AppData\Local\Temp\A505.tmp"69⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\A553.tmp"C:\Users\Admin\AppData\Local\Temp\A553.tmp"70⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"C:\Users\Admin\AppData\Local\Temp\A5B1.tmp"71⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"C:\Users\Admin\AppData\Local\Temp\A5FF.tmp"72⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\A64D.tmp"C:\Users\Admin\AppData\Local\Temp\A64D.tmp"73⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\A69B.tmp"C:\Users\Admin\AppData\Local\Temp\A69B.tmp"74⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"C:\Users\Admin\AppData\Local\Temp\A6E9.tmp"75⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\A747.tmp"C:\Users\Admin\AppData\Local\Temp\A747.tmp"76⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"C:\Users\Admin\AppData\Local\Temp\A7A5.tmp"77⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\A803.tmp"C:\Users\Admin\AppData\Local\Temp\A803.tmp"78⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\A860.tmp"C:\Users\Admin\AppData\Local\Temp\A860.tmp"79⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"C:\Users\Admin\AppData\Local\Temp\A8BE.tmp"80⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\A90C.tmp"C:\Users\Admin\AppData\Local\Temp\A90C.tmp"81⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\A96A.tmp"C:\Users\Admin\AppData\Local\Temp\A96A.tmp"82⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"C:\Users\Admin\AppData\Local\Temp\A9C8.tmp"83⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\AA16.tmp"C:\Users\Admin\AppData\Local\Temp\AA16.tmp"84⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\AA74.tmp"C:\Users\Admin\AppData\Local\Temp\AA74.tmp"85⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"86⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"87⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"C:\Users\Admin\AppData\Local\Temp\AB7D.tmp"88⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"C:\Users\Admin\AppData\Local\Temp\ABDB.tmp"89⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\AC39.tmp"C:\Users\Admin\AppData\Local\Temp\AC39.tmp"90⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\AC87.tmp"C:\Users\Admin\AppData\Local\Temp\AC87.tmp"91⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"C:\Users\Admin\AppData\Local\Temp\ACD5.tmp"92⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\AD23.tmp"C:\Users\Admin\AppData\Local\Temp\AD23.tmp"93⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\AD71.tmp"C:\Users\Admin\AppData\Local\Temp\AD71.tmp"94⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"C:\Users\Admin\AppData\Local\Temp\ADCF.tmp"95⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"C:\Users\Admin\AppData\Local\Temp\AE1D.tmp"96⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"C:\Users\Admin\AppData\Local\Temp\AE6B.tmp"97⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"C:\Users\Admin\AppData\Local\Temp\AEB9.tmp"98⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\AF08.tmp"C:\Users\Admin\AppData\Local\Temp\AF08.tmp"99⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\AF56.tmp"C:\Users\Admin\AppData\Local\Temp\AF56.tmp"100⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"101⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\B011.tmp"C:\Users\Admin\AppData\Local\Temp\B011.tmp"102⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\B06F.tmp"C:\Users\Admin\AppData\Local\Temp\B06F.tmp"103⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"C:\Users\Admin\AppData\Local\Temp\B0CD.tmp"104⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\B12A.tmp"C:\Users\Admin\AppData\Local\Temp\B12A.tmp"105⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\B188.tmp"C:\Users\Admin\AppData\Local\Temp\B188.tmp"106⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"C:\Users\Admin\AppData\Local\Temp\B1D6.tmp"107⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\B224.tmp"C:\Users\Admin\AppData\Local\Temp\B224.tmp"108⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\B273.tmp"C:\Users\Admin\AppData\Local\Temp\B273.tmp"109⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"C:\Users\Admin\AppData\Local\Temp\B2C1.tmp"110⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\B31E.tmp"C:\Users\Admin\AppData\Local\Temp\B31E.tmp"111⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\B36D.tmp"C:\Users\Admin\AppData\Local\Temp\B36D.tmp"112⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"C:\Users\Admin\AppData\Local\Temp\B3BB.tmp"113⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"114⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\B457.tmp"C:\Users\Admin\AppData\Local\Temp\B457.tmp"115⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"C:\Users\Admin\AppData\Local\Temp\B4A5.tmp"116⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"C:\Users\Admin\AppData\Local\Temp\B4F3.tmp"117⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\B541.tmp"C:\Users\Admin\AppData\Local\Temp\B541.tmp"118⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\B58F.tmp"C:\Users\Admin\AppData\Local\Temp\B58F.tmp"119⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"C:\Users\Admin\AppData\Local\Temp\B5ED.tmp"120⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\B63B.tmp"C:\Users\Admin\AppData\Local\Temp\B63B.tmp"121⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\B689.tmp"C:\Users\Admin\AppData\Local\Temp\B689.tmp"122⤵PID:824
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-