Analysis
-
max time kernel
150s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10-05-2024 00:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe
-
Size
488KB
-
MD5
a13b787619f208247cdeea055a1e6fc8
-
SHA1
657ae88245adb4ded3c0a9daf7e8f65c292f67e9
-
SHA256
c2a1af7d80b90ff58f651000ece8e732ac905434b112d0fa561bafe0eee867f3
-
SHA512
5762b81b3ae7fad09b3f0a4d55d5f538ccffee93dd8d5833b4717033408adb993bdc32270e80b7090ea9ebadcdfa3ca6a2d3f118f95ac80e950f383b7e0e931a
-
SSDEEP
12288:/U5rCOTeiD3xxfXw9O7DDrEmeZ8sEAQrjNZ:/UQOJD3rfXwM/wmeZ5yjN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3068 49AB.tmp 3880 4A28.tmp 4128 4AB5.tmp 992 4B32.tmp 3480 4BCE.tmp 3428 4C4B.tmp 3188 4CB8.tmp 3048 4D07.tmp 3108 4D84.tmp 1232 4E01.tmp 2720 4E5E.tmp 4376 4ECC.tmp 1000 4F58.tmp 1424 4FD5.tmp 1588 5033.tmp 5072 5091.tmp 1164 50DF.tmp 920 513D.tmp 1876 51AA.tmp 4588 5208.tmp 4252 5266.tmp 3156 52C3.tmp 1900 5311.tmp 2468 536F.tmp 928 53EC.tmp 3056 543A.tmp 3676 5488.tmp 3688 54F6.tmp 2588 5573.tmp 1988 55FF.tmp 4516 568C.tmp 2332 5709.tmp 532 5767.tmp 3456 57C5.tmp 1832 5822.tmp 804 5870.tmp 2728 58BF.tmp 4640 591C.tmp 2360 597A.tmp 2780 59D8.tmp 448 5A26.tmp 1064 5A84.tmp 116 5AD2.tmp 2584 5B30.tmp 4216 5B7E.tmp 2096 5BCC.tmp 4980 5C68.tmp 2180 5CC6.tmp 4432 5D24.tmp 3068 5D72.tmp 3412 5DCF.tmp 464 5E2D.tmp 1044 5E7B.tmp 2348 5EC9.tmp 2804 5F27.tmp 1088 5F85.tmp 1452 5FD3.tmp 3480 6021.tmp 2484 606F.tmp 3720 60CD.tmp 5112 612B.tmp 3084 6189.tmp 620 61D7.tmp 1852 6225.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4532 wrote to memory of 3068 4532 2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe 81 PID 4532 wrote to memory of 3068 4532 2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe 81 PID 4532 wrote to memory of 3068 4532 2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe 81 PID 3068 wrote to memory of 3880 3068 49AB.tmp 84 PID 3068 wrote to memory of 3880 3068 49AB.tmp 84 PID 3068 wrote to memory of 3880 3068 49AB.tmp 84 PID 3880 wrote to memory of 4128 3880 4A28.tmp 85 PID 3880 wrote to memory of 4128 3880 4A28.tmp 85 PID 3880 wrote to memory of 4128 3880 4A28.tmp 85 PID 4128 wrote to memory of 992 4128 4AB5.tmp 87 PID 4128 wrote to memory of 992 4128 4AB5.tmp 87 PID 4128 wrote to memory of 992 4128 4AB5.tmp 87 PID 992 wrote to memory of 3480 992 4B32.tmp 88 PID 992 wrote to memory of 3480 992 4B32.tmp 88 PID 992 wrote to memory of 3480 992 4B32.tmp 88 PID 3480 wrote to memory of 3428 3480 4BCE.tmp 89 PID 3480 wrote to memory of 3428 3480 4BCE.tmp 89 PID 3480 wrote to memory of 3428 3480 4BCE.tmp 89 PID 3428 wrote to memory of 3188 3428 4C4B.tmp 90 PID 3428 wrote to memory of 3188 3428 4C4B.tmp 90 PID 3428 wrote to memory of 3188 3428 4C4B.tmp 90 PID 3188 wrote to memory of 3048 3188 4CB8.tmp 91 PID 3188 wrote to memory of 3048 3188 4CB8.tmp 91 PID 3188 wrote to memory of 3048 3188 4CB8.tmp 91 PID 3048 wrote to memory of 3108 3048 4D07.tmp 92 PID 3048 wrote to memory of 3108 3048 4D07.tmp 92 PID 3048 wrote to memory of 3108 3048 4D07.tmp 92 PID 3108 wrote to memory of 1232 3108 4D84.tmp 93 PID 3108 wrote to memory of 1232 3108 4D84.tmp 93 PID 3108 wrote to memory of 1232 3108 4D84.tmp 93 PID 1232 wrote to memory of 2720 1232 4E01.tmp 94 PID 1232 wrote to memory of 2720 1232 4E01.tmp 94 PID 1232 wrote to memory of 2720 1232 4E01.tmp 94 PID 2720 wrote to memory of 4376 2720 4E5E.tmp 95 PID 2720 wrote to memory of 4376 2720 4E5E.tmp 95 PID 2720 wrote to memory of 4376 2720 4E5E.tmp 95 PID 4376 wrote to memory of 1000 4376 4ECC.tmp 96 PID 4376 wrote to memory of 1000 4376 4ECC.tmp 96 PID 4376 wrote to memory of 1000 4376 4ECC.tmp 96 PID 1000 wrote to memory of 1424 1000 4F58.tmp 97 PID 1000 wrote to memory of 1424 1000 4F58.tmp 97 PID 1000 wrote to memory of 1424 1000 4F58.tmp 97 PID 1424 wrote to memory of 1588 1424 4FD5.tmp 99 PID 1424 wrote to memory of 1588 1424 4FD5.tmp 99 PID 1424 wrote to memory of 1588 1424 4FD5.tmp 99 PID 1588 wrote to memory of 5072 1588 5033.tmp 100 PID 1588 wrote to memory of 5072 1588 5033.tmp 100 PID 1588 wrote to memory of 5072 1588 5033.tmp 100 PID 5072 wrote to memory of 1164 5072 5091.tmp 101 PID 5072 wrote to memory of 1164 5072 5091.tmp 101 PID 5072 wrote to memory of 1164 5072 5091.tmp 101 PID 1164 wrote to memory of 920 1164 50DF.tmp 102 PID 1164 wrote to memory of 920 1164 50DF.tmp 102 PID 1164 wrote to memory of 920 1164 50DF.tmp 102 PID 920 wrote to memory of 1876 920 513D.tmp 103 PID 920 wrote to memory of 1876 920 513D.tmp 103 PID 920 wrote to memory of 1876 920 513D.tmp 103 PID 1876 wrote to memory of 4588 1876 51AA.tmp 104 PID 1876 wrote to memory of 4588 1876 51AA.tmp 104 PID 1876 wrote to memory of 4588 1876 51AA.tmp 104 PID 4588 wrote to memory of 4252 4588 5208.tmp 106 PID 4588 wrote to memory of 4252 4588 5208.tmp 106 PID 4588 wrote to memory of 4252 4588 5208.tmp 106 PID 4252 wrote to memory of 3156 4252 5266.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-09_a13b787619f208247cdeea055a1e6fc8_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"23⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"24⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"25⤵
- Executes dropped EXE
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"26⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"27⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"28⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"29⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"30⤵
- Executes dropped EXE
PID:2588 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"31⤵
- Executes dropped EXE
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"32⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"33⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"34⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"35⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"36⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"37⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"38⤵
- Executes dropped EXE
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"39⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"40⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"41⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"42⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"43⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"44⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"45⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"46⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"47⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"48⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"49⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"50⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"51⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"52⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"53⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"54⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"55⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"56⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"57⤵
- Executes dropped EXE
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"58⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"59⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"60⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"61⤵
- Executes dropped EXE
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"62⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"63⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"64⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"65⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"66⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"67⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"68⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"69⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"70⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"71⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"72⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"73⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"74⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"75⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"76⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"77⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"78⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"79⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"80⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"81⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"82⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"83⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"84⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"85⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"86⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"87⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"88⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"89⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"90⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"91⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"92⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"93⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"94⤵PID:1208
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"95⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"96⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"97⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"98⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"99⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"100⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"101⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"102⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"103⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"104⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"105⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"106⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"107⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"108⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"109⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"110⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"111⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"112⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"113⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"114⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"115⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"116⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"117⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"118⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"119⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"120⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"121⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"122⤵PID:3516
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-