Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 22:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe
-
Size
488KB
-
MD5
0bc52370976c4161e8f9bab9e6f0e03f
-
SHA1
a8b20ec7cfcf1019f426cd6a3dd5ffa9bdc140db
-
SHA256
1a859ffb81139d537b868bf0f1329e8955e49c31485d50792e4a4afb2d79f014
-
SHA512
bcfb701772c5e19397531cf04a7ec8d7fa98ef3cb66506018679a1288a36f4948e686d9053f4a637898a061ea6e3ae2d73d1a44a7dcb65556a4ce66263fbb828
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7vrS+bh31yhjFmLdMJ+iCtZFg0ZuODH/XUus6:/U5rCOTeiD9qko+iCa0/k1y+W0ZeNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3344 708C.tmp 3820 7109.tmp 1840 7177.tmp 2632 71F4.tmp 2352 7251.tmp 2788 72A0.tmp 624 72EE.tmp 804 733C.tmp 4212 739A.tmp 1440 7417.tmp 2396 7484.tmp 4948 74E2.tmp 4612 7530.tmp 1968 758E.tmp 1796 75DC.tmp 2616 7639.tmp 2712 76A7.tmp 3576 76F5.tmp 4864 7753.tmp 4728 77A1.tmp 3180 77EF.tmp 4328 783D.tmp 2792 78AA.tmp 2348 7918.tmp 3172 7976.tmp 2956 79F3.tmp 3572 7A41.tmp 3988 7AAE.tmp 2316 7AFC.tmp 4284 7B5A.tmp 4356 7BB8.tmp 708 7C15.tmp 4128 7C83.tmp 4320 7CD1.tmp 1524 7D2F.tmp 3944 7D8C.tmp 1400 7DDB.tmp 4176 7E38.tmp 800 7E96.tmp 224 7EE4.tmp 4484 7F42.tmp 632 7FA0.tmp 3644 7FFD.tmp 4412 804C.tmp 2440 809A.tmp 3936 80E8.tmp 1864 8146.tmp 2008 81A3.tmp 4892 8201.tmp 1096 824F.tmp 904 829D.tmp 1732 82EB.tmp 3392 833A.tmp 3784 8397.tmp 4076 83F5.tmp 1700 8443.tmp 1516 84A1.tmp 4308 84EF.tmp 2956 854D.tmp 3308 859B.tmp 2436 85F9.tmp 1112 8656.tmp 536 86B4.tmp 3060 8712.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4984 wrote to memory of 3344 4984 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 87 PID 4984 wrote to memory of 3344 4984 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 87 PID 4984 wrote to memory of 3344 4984 2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe 87 PID 3344 wrote to memory of 3820 3344 708C.tmp 88 PID 3344 wrote to memory of 3820 3344 708C.tmp 88 PID 3344 wrote to memory of 3820 3344 708C.tmp 88 PID 3820 wrote to memory of 1840 3820 7109.tmp 89 PID 3820 wrote to memory of 1840 3820 7109.tmp 89 PID 3820 wrote to memory of 1840 3820 7109.tmp 89 PID 1840 wrote to memory of 2632 1840 7177.tmp 91 PID 1840 wrote to memory of 2632 1840 7177.tmp 91 PID 1840 wrote to memory of 2632 1840 7177.tmp 91 PID 2632 wrote to memory of 2352 2632 71F4.tmp 93 PID 2632 wrote to memory of 2352 2632 71F4.tmp 93 PID 2632 wrote to memory of 2352 2632 71F4.tmp 93 PID 2352 wrote to memory of 2788 2352 7251.tmp 94 PID 2352 wrote to memory of 2788 2352 7251.tmp 94 PID 2352 wrote to memory of 2788 2352 7251.tmp 94 PID 2788 wrote to memory of 624 2788 72A0.tmp 96 PID 2788 wrote to memory of 624 2788 72A0.tmp 96 PID 2788 wrote to memory of 624 2788 72A0.tmp 96 PID 624 wrote to memory of 804 624 72EE.tmp 97 PID 624 wrote to memory of 804 624 72EE.tmp 97 PID 624 wrote to memory of 804 624 72EE.tmp 97 PID 804 wrote to memory of 4212 804 733C.tmp 98 PID 804 wrote to memory of 4212 804 733C.tmp 98 PID 804 wrote to memory of 4212 804 733C.tmp 98 PID 4212 wrote to memory of 1440 4212 739A.tmp 99 PID 4212 wrote to memory of 1440 4212 739A.tmp 99 PID 4212 wrote to memory of 1440 4212 739A.tmp 99 PID 1440 wrote to memory of 2396 1440 7417.tmp 100 PID 1440 wrote to memory of 2396 1440 7417.tmp 100 PID 1440 wrote to memory of 2396 1440 7417.tmp 100 PID 2396 wrote to memory of 4948 2396 7484.tmp 101 PID 2396 wrote to memory of 4948 2396 7484.tmp 101 PID 2396 wrote to memory of 4948 2396 7484.tmp 101 PID 4948 wrote to memory of 4612 4948 74E2.tmp 102 PID 4948 wrote to memory of 4612 4948 74E2.tmp 102 PID 4948 wrote to memory of 4612 4948 74E2.tmp 102 PID 4612 wrote to memory of 1968 4612 7530.tmp 103 PID 4612 wrote to memory of 1968 4612 7530.tmp 103 PID 4612 wrote to memory of 1968 4612 7530.tmp 103 PID 1968 wrote to memory of 1796 1968 758E.tmp 104 PID 1968 wrote to memory of 1796 1968 758E.tmp 104 PID 1968 wrote to memory of 1796 1968 758E.tmp 104 PID 1796 wrote to memory of 2616 1796 75DC.tmp 105 PID 1796 wrote to memory of 2616 1796 75DC.tmp 105 PID 1796 wrote to memory of 2616 1796 75DC.tmp 105 PID 2616 wrote to memory of 2712 2616 7639.tmp 106 PID 2616 wrote to memory of 2712 2616 7639.tmp 106 PID 2616 wrote to memory of 2712 2616 7639.tmp 106 PID 2712 wrote to memory of 3576 2712 76A7.tmp 107 PID 2712 wrote to memory of 3576 2712 76A7.tmp 107 PID 2712 wrote to memory of 3576 2712 76A7.tmp 107 PID 3576 wrote to memory of 4864 3576 76F5.tmp 108 PID 3576 wrote to memory of 4864 3576 76F5.tmp 108 PID 3576 wrote to memory of 4864 3576 76F5.tmp 108 PID 4864 wrote to memory of 4728 4864 7753.tmp 109 PID 4864 wrote to memory of 4728 4864 7753.tmp 109 PID 4864 wrote to memory of 4728 4864 7753.tmp 109 PID 4728 wrote to memory of 3180 4728 77A1.tmp 110 PID 4728 wrote to memory of 3180 4728 77A1.tmp 110 PID 4728 wrote to memory of 3180 4728 77A1.tmp 110 PID 3180 wrote to memory of 4328 3180 77EF.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_0bc52370976c4161e8f9bab9e6f0e03f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3820 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\72EE.tmp"C:\Users\Admin\AppData\Local\Temp\72EE.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Users\Admin\AppData\Local\Temp\733C.tmp"C:\Users\Admin\AppData\Local\Temp\733C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:804 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\7484.tmp"C:\Users\Admin\AppData\Local\Temp\7484.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\75DC.tmp"C:\Users\Admin\AppData\Local\Temp\75DC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\7639.tmp"C:\Users\Admin\AppData\Local\Temp\7639.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"23⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"24⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"25⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"26⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"27⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\7A41.tmp"C:\Users\Admin\AppData\Local\Temp\7A41.tmp"28⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"29⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"30⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"31⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"32⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"33⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"34⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"35⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"36⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"C:\Users\Admin\AppData\Local\Temp\7D8C.tmp"37⤵
- Executes dropped EXE
PID:3944 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"38⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"39⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"40⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"41⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\7F42.tmp"C:\Users\Admin\AppData\Local\Temp\7F42.tmp"42⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"43⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"44⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"45⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"46⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"47⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8146.tmp"C:\Users\Admin\AppData\Local\Temp\8146.tmp"48⤵
- Executes dropped EXE
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"49⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"50⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"51⤵
- Executes dropped EXE
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"52⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\82EB.tmp"C:\Users\Admin\AppData\Local\Temp\82EB.tmp"53⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"54⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\8397.tmp"C:\Users\Admin\AppData\Local\Temp\8397.tmp"55⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"56⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"57⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\84A1.tmp"C:\Users\Admin\AppData\Local\Temp\84A1.tmp"58⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\84EF.tmp"C:\Users\Admin\AppData\Local\Temp\84EF.tmp"59⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"60⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"61⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\85F9.tmp"C:\Users\Admin\AppData\Local\Temp\85F9.tmp"62⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"63⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"64⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"65⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\8770.tmp"C:\Users\Admin\AppData\Local\Temp\8770.tmp"66⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\87CD.tmp"C:\Users\Admin\AppData\Local\Temp\87CD.tmp"67⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\881C.tmp"C:\Users\Admin\AppData\Local\Temp\881C.tmp"68⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"69⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"70⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"71⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"72⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"73⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"74⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"75⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"C:\Users\Admin\AppData\Local\Temp\8ADB.tmp"76⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\8B38.tmp"C:\Users\Admin\AppData\Local\Temp\8B38.tmp"77⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"78⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"79⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"80⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"C:\Users\Admin\AppData\Local\Temp\8CA0.tmp"81⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"C:\Users\Admin\AppData\Local\Temp\8CEE.tmp"82⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"C:\Users\Admin\AppData\Local\Temp\8D4C.tmp"83⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"84⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"85⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"86⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp"87⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"88⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"89⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"90⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\901A.tmp"C:\Users\Admin\AppData\Local\Temp\901A.tmp"91⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"92⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\90D6.tmp"C:\Users\Admin\AppData\Local\Temp\90D6.tmp"93⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\9124.tmp"C:\Users\Admin\AppData\Local\Temp\9124.tmp"94⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"95⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"96⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"97⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\927C.tmp"C:\Users\Admin\AppData\Local\Temp\927C.tmp"98⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"99⤵PID:100
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"100⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"101⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"102⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"103⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\948F.tmp"C:\Users\Admin\AppData\Local\Temp\948F.tmp"104⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"105⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"106⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"107⤵PID:3572
-
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"108⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\9635.tmp"C:\Users\Admin\AppData\Local\Temp\9635.tmp"109⤵PID:1660
-
C:\Users\Admin\AppData\Local\Temp\9693.tmp"C:\Users\Admin\AppData\Local\Temp\9693.tmp"110⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"111⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"112⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"113⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"114⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"115⤵PID:708
-
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"116⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"117⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\9923.tmp"C:\Users\Admin\AppData\Local\Temp\9923.tmp"118⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"119⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"120⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"121⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"122⤵PID:3900
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-