Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24/05/2024, 19:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe
-
Size
487KB
-
MD5
b9e40bd5d30256305762b27a42be7d80
-
SHA1
b74c7b7f0c05df9dd41cbf9917e45287b78d4421
-
SHA256
7b8b957eaec0f332b48cae8c5e057b547d5b924c82fca2885fa733c991fcb12b
-
SHA512
a68f7134169073baa06c139f00eda693443a7134910b3f97207c1b259c9d68c33d56baa8ab8524ce696566cbe7b59c9c1e41fb6550f674b415ce5681db571f45
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUNpnQtkdPMy+3Hw09SpStvVLK92TfVQ5k2msz:HU5rCOTeiJOQAPfKSI3kWWkwNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1632 251C.tmp 2760 2589.tmp 1528 2606.tmp 2664 2674.tmp 4484 26E1.tmp 2912 273F.tmp 2132 278D.tmp 1264 27EB.tmp 692 2868.tmp 2608 28C5.tmp 636 2933.tmp 4672 29A0.tmp 3100 29EE.tmp 4412 2A3C.tmp 2544 2AAA.tmp 4636 2AF8.tmp 1936 2B46.tmp 2264 2BA4.tmp 4408 2BF2.tmp 3848 2C5F.tmp 1440 2CAD.tmp 640 2CFB.tmp 1268 2D4A.tmp 1044 2DB7.tmp 4100 2E05.tmp 4224 2E72.tmp 2508 2EC1.tmp 4848 2F1E.tmp 880 2F8C.tmp 3716 2FF9.tmp 4872 3066.tmp 2604 30B5.tmp 3596 3112.tmp 436 3170.tmp 264 31CE.tmp 3400 321C.tmp 2168 327A.tmp 620 32C8.tmp 4336 3345.tmp 2952 3393.tmp 3200 33F1.tmp 456 343F.tmp 4212 349D.tmp 804 34FA.tmp 1528 3558.tmp 1516 35B6.tmp 412 3604.tmp 4640 3662.tmp 5064 36B0.tmp 4312 370E.tmp 4660 375C.tmp 4924 37B9.tmp 4376 3827.tmp 760 3894.tmp 1908 38F2.tmp 692 395F.tmp 3868 39CD.tmp 2844 3A2A.tmp 4948 3A79.tmp 4672 3AD6.tmp 3344 3B44.tmp 5044 3BA1.tmp 2288 3BFF.tmp 4504 3C5D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4472 wrote to memory of 1632 4472 2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe 82 PID 4472 wrote to memory of 1632 4472 2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe 82 PID 4472 wrote to memory of 1632 4472 2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe 82 PID 1632 wrote to memory of 2760 1632 251C.tmp 83 PID 1632 wrote to memory of 2760 1632 251C.tmp 83 PID 1632 wrote to memory of 2760 1632 251C.tmp 83 PID 2760 wrote to memory of 1528 2760 2589.tmp 84 PID 2760 wrote to memory of 1528 2760 2589.tmp 84 PID 2760 wrote to memory of 1528 2760 2589.tmp 84 PID 1528 wrote to memory of 2664 1528 2606.tmp 85 PID 1528 wrote to memory of 2664 1528 2606.tmp 85 PID 1528 wrote to memory of 2664 1528 2606.tmp 85 PID 2664 wrote to memory of 4484 2664 2674.tmp 86 PID 2664 wrote to memory of 4484 2664 2674.tmp 86 PID 2664 wrote to memory of 4484 2664 2674.tmp 86 PID 4484 wrote to memory of 2912 4484 26E1.tmp 88 PID 4484 wrote to memory of 2912 4484 26E1.tmp 88 PID 4484 wrote to memory of 2912 4484 26E1.tmp 88 PID 2912 wrote to memory of 2132 2912 273F.tmp 89 PID 2912 wrote to memory of 2132 2912 273F.tmp 89 PID 2912 wrote to memory of 2132 2912 273F.tmp 89 PID 2132 wrote to memory of 1264 2132 278D.tmp 91 PID 2132 wrote to memory of 1264 2132 278D.tmp 91 PID 2132 wrote to memory of 1264 2132 278D.tmp 91 PID 1264 wrote to memory of 692 1264 27EB.tmp 93 PID 1264 wrote to memory of 692 1264 27EB.tmp 93 PID 1264 wrote to memory of 692 1264 27EB.tmp 93 PID 692 wrote to memory of 2608 692 2868.tmp 94 PID 692 wrote to memory of 2608 692 2868.tmp 94 PID 692 wrote to memory of 2608 692 2868.tmp 94 PID 2608 wrote to memory of 636 2608 28C5.tmp 95 PID 2608 wrote to memory of 636 2608 28C5.tmp 95 PID 2608 wrote to memory of 636 2608 28C5.tmp 95 PID 636 wrote to memory of 4672 636 2933.tmp 96 PID 636 wrote to memory of 4672 636 2933.tmp 96 PID 636 wrote to memory of 4672 636 2933.tmp 96 PID 4672 wrote to memory of 3100 4672 29A0.tmp 97 PID 4672 wrote to memory of 3100 4672 29A0.tmp 97 PID 4672 wrote to memory of 3100 4672 29A0.tmp 97 PID 3100 wrote to memory of 4412 3100 29EE.tmp 98 PID 3100 wrote to memory of 4412 3100 29EE.tmp 98 PID 3100 wrote to memory of 4412 3100 29EE.tmp 98 PID 4412 wrote to memory of 2544 4412 2A3C.tmp 99 PID 4412 wrote to memory of 2544 4412 2A3C.tmp 99 PID 4412 wrote to memory of 2544 4412 2A3C.tmp 99 PID 2544 wrote to memory of 4636 2544 2AAA.tmp 100 PID 2544 wrote to memory of 4636 2544 2AAA.tmp 100 PID 2544 wrote to memory of 4636 2544 2AAA.tmp 100 PID 4636 wrote to memory of 1936 4636 2AF8.tmp 101 PID 4636 wrote to memory of 1936 4636 2AF8.tmp 101 PID 4636 wrote to memory of 1936 4636 2AF8.tmp 101 PID 1936 wrote to memory of 2264 1936 2B46.tmp 102 PID 1936 wrote to memory of 2264 1936 2B46.tmp 102 PID 1936 wrote to memory of 2264 1936 2B46.tmp 102 PID 2264 wrote to memory of 4408 2264 2BA4.tmp 103 PID 2264 wrote to memory of 4408 2264 2BA4.tmp 103 PID 2264 wrote to memory of 4408 2264 2BA4.tmp 103 PID 4408 wrote to memory of 3848 4408 2BF2.tmp 104 PID 4408 wrote to memory of 3848 4408 2BF2.tmp 104 PID 4408 wrote to memory of 3848 4408 2BF2.tmp 104 PID 3848 wrote to memory of 1440 3848 2C5F.tmp 105 PID 3848 wrote to memory of 1440 3848 2C5F.tmp 105 PID 3848 wrote to memory of 1440 3848 2C5F.tmp 105 PID 1440 wrote to memory of 640 1440 2CAD.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_b9e40bd5d30256305762b27a42be7d80_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\251C.tmp"C:\Users\Admin\AppData\Local\Temp\251C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\2589.tmp"C:\Users\Admin\AppData\Local\Temp\2589.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2606.tmp"C:\Users\Admin\AppData\Local\Temp\2606.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\26E1.tmp"C:\Users\Admin\AppData\Local\Temp\26E1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\27EB.tmp"C:\Users\Admin\AppData\Local\Temp\27EB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\2868.tmp"C:\Users\Admin\AppData\Local\Temp\2868.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\2933.tmp"C:\Users\Admin\AppData\Local\Temp\2933.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Users\Admin\AppData\Local\Temp\29A0.tmp"C:\Users\Admin\AppData\Local\Temp\29A0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\29EE.tmp"C:\Users\Admin\AppData\Local\Temp\29EE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\2AAA.tmp"C:\Users\Admin\AppData\Local\Temp\2AAA.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"C:\Users\Admin\AppData\Local\Temp\2AF8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\2B46.tmp"C:\Users\Admin\AppData\Local\Temp\2B46.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2BA4.tmp"C:\Users\Admin\AppData\Local\Temp\2BA4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\2BF2.tmp"C:\Users\Admin\AppData\Local\Temp\2BF2.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"C:\Users\Admin\AppData\Local\Temp\2C5F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"C:\Users\Admin\AppData\Local\Temp\2CAD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\2CFB.tmp"C:\Users\Admin\AppData\Local\Temp\2CFB.tmp"23⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"C:\Users\Admin\AppData\Local\Temp\2D4A.tmp"24⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"C:\Users\Admin\AppData\Local\Temp\2DB7.tmp"25⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\2E05.tmp"C:\Users\Admin\AppData\Local\Temp\2E05.tmp"26⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\2E72.tmp"C:\Users\Admin\AppData\Local\Temp\2E72.tmp"27⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"C:\Users\Admin\AppData\Local\Temp\2EC1.tmp"28⤵
- Executes dropped EXE
PID:2508 -
C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"C:\Users\Admin\AppData\Local\Temp\2F1E.tmp"29⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"C:\Users\Admin\AppData\Local\Temp\2F8C.tmp"30⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"31⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3066.tmp"C:\Users\Admin\AppData\Local\Temp\3066.tmp"32⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"33⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\3112.tmp"C:\Users\Admin\AppData\Local\Temp\3112.tmp"34⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3170.tmp"C:\Users\Admin\AppData\Local\Temp\3170.tmp"35⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\31CE.tmp"C:\Users\Admin\AppData\Local\Temp\31CE.tmp"36⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"37⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\327A.tmp"C:\Users\Admin\AppData\Local\Temp\327A.tmp"38⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\32C8.tmp"C:\Users\Admin\AppData\Local\Temp\32C8.tmp"39⤵
- Executes dropped EXE
PID:620 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"40⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\3393.tmp"C:\Users\Admin\AppData\Local\Temp\3393.tmp"41⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"42⤵
- Executes dropped EXE
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"43⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\349D.tmp"C:\Users\Admin\AppData\Local\Temp\349D.tmp"44⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"45⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"46⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"47⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"48⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"49⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"50⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\370E.tmp"C:\Users\Admin\AppData\Local\Temp\370E.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"52⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\37B9.tmp"C:\Users\Admin\AppData\Local\Temp\37B9.tmp"53⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"54⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"55⤵
- Executes dropped EXE
PID:760 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"56⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"57⤵
- Executes dropped EXE
PID:692 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"58⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"59⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"60⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"61⤵
- Executes dropped EXE
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"62⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"63⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"64⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"65⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"66⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"67⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"68⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"69⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"70⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"71⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"72⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"73⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"74⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"75⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"76⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"77⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"78⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"79⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"80⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"81⤵PID:4264
-
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"82⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"83⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"84⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"85⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"86⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"87⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"88⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"89⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"90⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"91⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"92⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"93⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"94⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"95⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"96⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"97⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"98⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"99⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"100⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"101⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"102⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"103⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"104⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"105⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"106⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"107⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"108⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"109⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"110⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"111⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"112⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"113⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"114⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"115⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"116⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"117⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"118⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"119⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"120⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"121⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"122⤵PID:3872
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-