Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 01:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe
-
Size
530KB
-
MD5
242dc2d0a656d4c688bc64a24e52e962
-
SHA1
0ba31afdfa0d7dbd9c21ea42fd82084cae9906cf
-
SHA256
6b23ce9b5a1e3ebe3553819035aa81c0e26c70c6c5659050e320bf412e3f6fe5
-
SHA512
df1b73f79206820034a0a476e4582684f97f055d5f12c136c9b77ca63cdda4683b36307f036dd8fbec2ef5ec81d9e16409831fe1a55eb5ebf21886a18545e942
-
SSDEEP
12288:AU5rCOTeiougJA8iw2DftJIC6FnKIsNZulFVg0M1:AUQOJouo+XtJUKIsNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 720 AB9.tmp 984 CEC.tmp 2668 DA7.tmp 3824 E43.tmp 4280 F1E.tmp 2896 1047.tmp 3732 10F3.tmp 232 117F.tmp 924 125A.tmp 4204 1354.tmp 3956 13F0.tmp 696 145E.tmp 3828 14EA.tmp 2356 1567.tmp 1132 1690.tmp 3140 16FE.tmp 3092 176B.tmp 4616 1836.tmp 4212 18D2.tmp 4944 198E.tmp 1704 1A0B.tmp 3588 1A88.tmp 2312 1AF5.tmp 2284 1B92.tmp 896 1C0F.tmp 1136 1CCA.tmp 2416 1D47.tmp 2156 1DC4.tmp 2108 1E70.tmp 1980 1F1C.tmp 3112 1FA8.tmp 892 2054.tmp 4824 2100.tmp 3472 218D.tmp 2008 220A.tmp 844 2296.tmp 4016 2342.tmp 3980 23BF.tmp 3548 243C.tmp 2752 24AA.tmp 3968 2536.tmp 1148 25A4.tmp 5060 2601.tmp 2452 267E.tmp 4008 2778.tmp 1504 27E6.tmp 4128 2853.tmp 3732 28C1.tmp 232 294D.tmp 4356 29BB.tmp 4504 2A38.tmp 4204 2AA5.tmp 5064 2B12.tmp 3404 2B9F.tmp 4124 2C3B.tmp 1052 2CE7.tmp 3864 2D64.tmp 3468 2DD1.tmp 1996 2E6E.tmp 3380 2EEB.tmp 1704 2F68.tmp 3356 2FF4.tmp 4900 3071.tmp 3348 30FE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2772 wrote to memory of 720 2772 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 91 PID 2772 wrote to memory of 720 2772 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 91 PID 2772 wrote to memory of 720 2772 2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe 91 PID 720 wrote to memory of 984 720 AB9.tmp 92 PID 720 wrote to memory of 984 720 AB9.tmp 92 PID 720 wrote to memory of 984 720 AB9.tmp 92 PID 984 wrote to memory of 2668 984 CEC.tmp 93 PID 984 wrote to memory of 2668 984 CEC.tmp 93 PID 984 wrote to memory of 2668 984 CEC.tmp 93 PID 2668 wrote to memory of 3824 2668 DA7.tmp 94 PID 2668 wrote to memory of 3824 2668 DA7.tmp 94 PID 2668 wrote to memory of 3824 2668 DA7.tmp 94 PID 3824 wrote to memory of 4280 3824 E43.tmp 95 PID 3824 wrote to memory of 4280 3824 E43.tmp 95 PID 3824 wrote to memory of 4280 3824 E43.tmp 95 PID 4280 wrote to memory of 2896 4280 F1E.tmp 96 PID 4280 wrote to memory of 2896 4280 F1E.tmp 96 PID 4280 wrote to memory of 2896 4280 F1E.tmp 96 PID 2896 wrote to memory of 3732 2896 1047.tmp 140 PID 2896 wrote to memory of 3732 2896 1047.tmp 140 PID 2896 wrote to memory of 3732 2896 1047.tmp 140 PID 3732 wrote to memory of 232 3732 10F3.tmp 141 PID 3732 wrote to memory of 232 3732 10F3.tmp 141 PID 3732 wrote to memory of 232 3732 10F3.tmp 141 PID 232 wrote to memory of 924 232 117F.tmp 99 PID 232 wrote to memory of 924 232 117F.tmp 99 PID 232 wrote to memory of 924 232 117F.tmp 99 PID 924 wrote to memory of 4204 924 125A.tmp 145 PID 924 wrote to memory of 4204 924 125A.tmp 145 PID 924 wrote to memory of 4204 924 125A.tmp 145 PID 4204 wrote to memory of 3956 4204 1354.tmp 101 PID 4204 wrote to memory of 3956 4204 1354.tmp 101 PID 4204 wrote to memory of 3956 4204 1354.tmp 101 PID 3956 wrote to memory of 696 3956 13F0.tmp 102 PID 3956 wrote to memory of 696 3956 13F0.tmp 102 PID 3956 wrote to memory of 696 3956 13F0.tmp 102 PID 696 wrote to memory of 3828 696 145E.tmp 103 PID 696 wrote to memory of 3828 696 145E.tmp 103 PID 696 wrote to memory of 3828 696 145E.tmp 103 PID 3828 wrote to memory of 2356 3828 14EA.tmp 104 PID 3828 wrote to memory of 2356 3828 14EA.tmp 104 PID 3828 wrote to memory of 2356 3828 14EA.tmp 104 PID 2356 wrote to memory of 1132 2356 1567.tmp 105 PID 2356 wrote to memory of 1132 2356 1567.tmp 105 PID 2356 wrote to memory of 1132 2356 1567.tmp 105 PID 1132 wrote to memory of 3140 1132 1690.tmp 106 PID 1132 wrote to memory of 3140 1132 1690.tmp 106 PID 1132 wrote to memory of 3140 1132 1690.tmp 106 PID 3140 wrote to memory of 3092 3140 16FE.tmp 107 PID 3140 wrote to memory of 3092 3140 16FE.tmp 107 PID 3140 wrote to memory of 3092 3140 16FE.tmp 107 PID 3092 wrote to memory of 4616 3092 176B.tmp 108 PID 3092 wrote to memory of 4616 3092 176B.tmp 108 PID 3092 wrote to memory of 4616 3092 176B.tmp 108 PID 4616 wrote to memory of 4212 4616 1836.tmp 109 PID 4616 wrote to memory of 4212 4616 1836.tmp 109 PID 4616 wrote to memory of 4212 4616 1836.tmp 109 PID 4212 wrote to memory of 4944 4212 18D2.tmp 110 PID 4212 wrote to memory of 4944 4212 18D2.tmp 110 PID 4212 wrote to memory of 4944 4212 18D2.tmp 110 PID 4944 wrote to memory of 1704 4944 198E.tmp 155 PID 4944 wrote to memory of 1704 4944 198E.tmp 155 PID 4944 wrote to memory of 1704 4944 198E.tmp 155 PID 1704 wrote to memory of 3588 1704 1A0B.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_242dc2d0a656d4c688bc64a24e52e962_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\AB9.tmp"C:\Users\Admin\AppData\Local\Temp\AB9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\117F.tmp"C:\Users\Admin\AppData\Local\Temp\117F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\13F0.tmp"C:\Users\Admin\AppData\Local\Temp\13F0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\145E.tmp"C:\Users\Admin\AppData\Local\Temp\145E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Users\Admin\AppData\Local\Temp\14EA.tmp"C:\Users\Admin\AppData\Local\Temp\14EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\1567.tmp"C:\Users\Admin\AppData\Local\Temp\1567.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\16FE.tmp"C:\Users\Admin\AppData\Local\Temp\16FE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\176B.tmp"C:\Users\Admin\AppData\Local\Temp\176B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\18D2.tmp"C:\Users\Admin\AppData\Local\Temp\18D2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\198E.tmp"C:\Users\Admin\AppData\Local\Temp\198E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"C:\Users\Admin\AppData\Local\Temp\1A0B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"23⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"24⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp"25⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"26⤵
- Executes dropped EXE
PID:896 -
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"27⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\1D47.tmp"C:\Users\Admin\AppData\Local\Temp\1D47.tmp"28⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"C:\Users\Admin\AppData\Local\Temp\1DC4.tmp"29⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\1E70.tmp"C:\Users\Admin\AppData\Local\Temp\1E70.tmp"30⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"C:\Users\Admin\AppData\Local\Temp\1F1C.tmp"31⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"C:\Users\Admin\AppData\Local\Temp\1FA8.tmp"32⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\2054.tmp"C:\Users\Admin\AppData\Local\Temp\2054.tmp"33⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\2100.tmp"C:\Users\Admin\AppData\Local\Temp\2100.tmp"34⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"35⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"36⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\2296.tmp"C:\Users\Admin\AppData\Local\Temp\2296.tmp"37⤵
- Executes dropped EXE
PID:844 -
C:\Users\Admin\AppData\Local\Temp\2342.tmp"C:\Users\Admin\AppData\Local\Temp\2342.tmp"38⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"39⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\243C.tmp"C:\Users\Admin\AppData\Local\Temp\243C.tmp"40⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\24AA.tmp"C:\Users\Admin\AppData\Local\Temp\24AA.tmp"41⤵
- Executes dropped EXE
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\2536.tmp"C:\Users\Admin\AppData\Local\Temp\2536.tmp"42⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"43⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\2601.tmp"C:\Users\Admin\AppData\Local\Temp\2601.tmp"44⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\267E.tmp"C:\Users\Admin\AppData\Local\Temp\267E.tmp"45⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\2778.tmp"C:\Users\Admin\AppData\Local\Temp\2778.tmp"46⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"47⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\2853.tmp"C:\Users\Admin\AppData\Local\Temp\2853.tmp"48⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\28C1.tmp"C:\Users\Admin\AppData\Local\Temp\28C1.tmp"49⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\294D.tmp"C:\Users\Admin\AppData\Local\Temp\294D.tmp"50⤵
- Executes dropped EXE
PID:232 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"51⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"52⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"C:\Users\Admin\AppData\Local\Temp\2AA5.tmp"53⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\2B12.tmp"C:\Users\Admin\AppData\Local\Temp\2B12.tmp"54⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"55⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"56⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"C:\Users\Admin\AppData\Local\Temp\2CE7.tmp"57⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\2D64.tmp"C:\Users\Admin\AppData\Local\Temp\2D64.tmp"58⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"C:\Users\Admin\AppData\Local\Temp\2DD1.tmp"59⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"C:\Users\Admin\AppData\Local\Temp\2E6E.tmp"60⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"61⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"62⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"63⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\3071.tmp"C:\Users\Admin\AppData\Local\Temp\3071.tmp"64⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"65⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\31B9.tmp"C:\Users\Admin\AppData\Local\Temp\31B9.tmp"66⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\3256.tmp"C:\Users\Admin\AppData\Local\Temp\3256.tmp"67⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"68⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\33AD.tmp"C:\Users\Admin\AppData\Local\Temp\33AD.tmp"69⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\3469.tmp"C:\Users\Admin\AppData\Local\Temp\3469.tmp"70⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"71⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"72⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\362E.tmp"C:\Users\Admin\AppData\Local\Temp\362E.tmp"73⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"74⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\3747.tmp"C:\Users\Admin\AppData\Local\Temp\3747.tmp"75⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\37E4.tmp"C:\Users\Admin\AppData\Local\Temp\37E4.tmp"76⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\3851.tmp"C:\Users\Admin\AppData\Local\Temp\3851.tmp"77⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"78⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"79⤵PID:4248
-
C:\Users\Admin\AppData\Local\Temp\3A93.tmp"C:\Users\Admin\AppData\Local\Temp\3A93.tmp"80⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\3B10.tmp"C:\Users\Admin\AppData\Local\Temp\3B10.tmp"81⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"82⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"83⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\3D23.tmp"C:\Users\Admin\AppData\Local\Temp\3D23.tmp"84⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"C:\Users\Admin\AppData\Local\Temp\3DCF.tmp"85⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"C:\Users\Admin\AppData\Local\Temp\3E6B.tmp"86⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"87⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"88⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"89⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"90⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\4273.tmp"C:\Users\Admin\AppData\Local\Temp\4273.tmp"91⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\437C.tmp"C:\Users\Admin\AppData\Local\Temp\437C.tmp"92⤵PID:4128
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"93⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\4486.tmp"C:\Users\Admin\AppData\Local\Temp\4486.tmp"94⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"95⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\45AF.tmp"C:\Users\Admin\AppData\Local\Temp\45AF.tmp"96⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\462C.tmp"C:\Users\Admin\AppData\Local\Temp\462C.tmp"97⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\46A9.tmp"C:\Users\Admin\AppData\Local\Temp\46A9.tmp"98⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"99⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"C:\Users\Admin\AppData\Local\Temp\4BBA.tmp"100⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"101⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"102⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"103⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\4E98.tmp"C:\Users\Admin\AppData\Local\Temp\4E98.tmp"104⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"105⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"106⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"107⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"108⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\50F9.tmp"C:\Users\Admin\AppData\Local\Temp\50F9.tmp"109⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\51A5.tmp"C:\Users\Admin\AppData\Local\Temp\51A5.tmp"110⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\5222.tmp"C:\Users\Admin\AppData\Local\Temp\5222.tmp"111⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\529F.tmp"C:\Users\Admin\AppData\Local\Temp\529F.tmp"112⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"113⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\53C8.tmp"C:\Users\Admin\AppData\Local\Temp\53C8.tmp"114⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5436.tmp"C:\Users\Admin\AppData\Local\Temp\5436.tmp"115⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\54B3.tmp"C:\Users\Admin\AppData\Local\Temp\54B3.tmp"116⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\553F.tmp"C:\Users\Admin\AppData\Local\Temp\553F.tmp"117⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"118⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\5639.tmp"C:\Users\Admin\AppData\Local\Temp\5639.tmp"119⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\56C6.tmp"C:\Users\Admin\AppData\Local\Temp\56C6.tmp"120⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5752.tmp"C:\Users\Admin\AppData\Local\Temp\5752.tmp"121⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\57EF.tmp"C:\Users\Admin\AppData\Local\Temp\57EF.tmp"122⤵PID:2240
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-