Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 23:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe
Resource
win10v2004-20231222-en
2 signatures
150 seconds
General
-
Target
2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe
-
Size
765KB
-
MD5
8a052e00ea81224676b1e1ded9fc1643
-
SHA1
3f7c372ac8d584266661da8d4ccc37df1795c08f
-
SHA256
399810953bbfae7d36dd584c136aaad2c865860881bd3fc018abc34d55ac926f
-
SHA512
2d1a086473a1100d7aa6ea22998108998ac2ab8d92f2afbc3353ac8f21833c56768a77ccc2722785119207e0d2b9e0a1a6ef3b4de4efd086e2c2160be88433b1
-
SSDEEP
12288:ZU5rCOTeiDO01TV/LTkKLiVWhw/PKCy3ZF5rn5rLOa54U5w5A:ZUQOJDO01TVLTkK+VWhbP3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1408 4AF3.tmp 3100 4B61.tmp 1780 4BED.tmp 4368 4C8A.tmp 1740 4CF7.tmp 1908 4D84.tmp 2228 4DE1.tmp 2376 4E5E.tmp 4868 4EBC.tmp 4596 4F39.tmp 4356 4F97.tmp 3652 4FF5.tmp 2752 5052.tmp 3400 50B0.tmp 2700 510E.tmp 2340 516C.tmp 1528 51C9.tmp 2396 5227.tmp 4516 52A4.tmp 832 5302.tmp 4828 5360.tmp 4624 53DD.tmp 5048 542B.tmp 2404 5498.tmp 4740 54E6.tmp 3272 5534.tmp 2116 55A2.tmp 1596 55F0.tmp 912 565D.tmp 3648 56CB.tmp 1512 5757.tmp 440 57B5.tmp 2108 5822.tmp 2328 5870.tmp 2368 58BF.tmp 4984 590D.tmp 4540 596A.tmp 3860 59B9.tmp 1420 5A16.tmp 1284 5A74.tmp 4964 5AD2.tmp 2268 5B20.tmp 2412 5B7E.tmp 2524 5BDB.tmp 1488 5C2A.tmp 3680 5C87.tmp 4044 5CD5.tmp 2240 5D24.tmp 1516 5D72.tmp 3100 5DC0.tmp 2760 5E0E.tmp 1780 5E5C.tmp 1732 5EAA.tmp 3228 5EF8.tmp 3160 5F46.tmp 756 5F95.tmp 1076 5FF2.tmp 3180 6050.tmp 3580 609E.tmp 512 60FC.tmp 3532 615A.tmp 4616 61A8.tmp 4596 61F6.tmp 5032 6254.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 1408 1712 2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe 85 PID 1712 wrote to memory of 1408 1712 2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe 85 PID 1712 wrote to memory of 1408 1712 2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe 85 PID 1408 wrote to memory of 3100 1408 4AF3.tmp 86 PID 1408 wrote to memory of 3100 1408 4AF3.tmp 86 PID 1408 wrote to memory of 3100 1408 4AF3.tmp 86 PID 3100 wrote to memory of 1780 3100 4B61.tmp 87 PID 3100 wrote to memory of 1780 3100 4B61.tmp 87 PID 3100 wrote to memory of 1780 3100 4B61.tmp 87 PID 1780 wrote to memory of 4368 1780 4BED.tmp 88 PID 1780 wrote to memory of 4368 1780 4BED.tmp 88 PID 1780 wrote to memory of 4368 1780 4BED.tmp 88 PID 4368 wrote to memory of 1740 4368 4C8A.tmp 89 PID 4368 wrote to memory of 1740 4368 4C8A.tmp 89 PID 4368 wrote to memory of 1740 4368 4C8A.tmp 89 PID 1740 wrote to memory of 1908 1740 4CF7.tmp 90 PID 1740 wrote to memory of 1908 1740 4CF7.tmp 90 PID 1740 wrote to memory of 1908 1740 4CF7.tmp 90 PID 1908 wrote to memory of 2228 1908 4D84.tmp 91 PID 1908 wrote to memory of 2228 1908 4D84.tmp 91 PID 1908 wrote to memory of 2228 1908 4D84.tmp 91 PID 2228 wrote to memory of 2376 2228 4DE1.tmp 92 PID 2228 wrote to memory of 2376 2228 4DE1.tmp 92 PID 2228 wrote to memory of 2376 2228 4DE1.tmp 92 PID 2376 wrote to memory of 4868 2376 4E5E.tmp 93 PID 2376 wrote to memory of 4868 2376 4E5E.tmp 93 PID 2376 wrote to memory of 4868 2376 4E5E.tmp 93 PID 4868 wrote to memory of 4596 4868 4EBC.tmp 94 PID 4868 wrote to memory of 4596 4868 4EBC.tmp 94 PID 4868 wrote to memory of 4596 4868 4EBC.tmp 94 PID 4596 wrote to memory of 4356 4596 4F39.tmp 95 PID 4596 wrote to memory of 4356 4596 4F39.tmp 95 PID 4596 wrote to memory of 4356 4596 4F39.tmp 95 PID 4356 wrote to memory of 3652 4356 4F97.tmp 96 PID 4356 wrote to memory of 3652 4356 4F97.tmp 96 PID 4356 wrote to memory of 3652 4356 4F97.tmp 96 PID 3652 wrote to memory of 2752 3652 4FF5.tmp 97 PID 3652 wrote to memory of 2752 3652 4FF5.tmp 97 PID 3652 wrote to memory of 2752 3652 4FF5.tmp 97 PID 2752 wrote to memory of 3400 2752 5052.tmp 98 PID 2752 wrote to memory of 3400 2752 5052.tmp 98 PID 2752 wrote to memory of 3400 2752 5052.tmp 98 PID 3400 wrote to memory of 2700 3400 50B0.tmp 99 PID 3400 wrote to memory of 2700 3400 50B0.tmp 99 PID 3400 wrote to memory of 2700 3400 50B0.tmp 99 PID 2700 wrote to memory of 2340 2700 510E.tmp 100 PID 2700 wrote to memory of 2340 2700 510E.tmp 100 PID 2700 wrote to memory of 2340 2700 510E.tmp 100 PID 2340 wrote to memory of 1528 2340 516C.tmp 101 PID 2340 wrote to memory of 1528 2340 516C.tmp 101 PID 2340 wrote to memory of 1528 2340 516C.tmp 101 PID 1528 wrote to memory of 2396 1528 51C9.tmp 102 PID 1528 wrote to memory of 2396 1528 51C9.tmp 102 PID 1528 wrote to memory of 2396 1528 51C9.tmp 102 PID 2396 wrote to memory of 4516 2396 5227.tmp 103 PID 2396 wrote to memory of 4516 2396 5227.tmp 103 PID 2396 wrote to memory of 4516 2396 5227.tmp 103 PID 4516 wrote to memory of 832 4516 52A4.tmp 104 PID 4516 wrote to memory of 832 4516 52A4.tmp 104 PID 4516 wrote to memory of 832 4516 52A4.tmp 104 PID 832 wrote to memory of 4828 832 5302.tmp 105 PID 832 wrote to memory of 4828 832 5302.tmp 105 PID 832 wrote to memory of 4828 832 5302.tmp 105 PID 4828 wrote to memory of 4624 4828 5360.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_8a052e00ea81224676b1e1ded9fc1643_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"23⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"24⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"25⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"26⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"27⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"28⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"29⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"30⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"31⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"32⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"33⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"34⤵
- Executes dropped EXE
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"35⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"36⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"37⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"38⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"39⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"40⤵
- Executes dropped EXE
PID:1420 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"41⤵
- Executes dropped EXE
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"42⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"43⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"44⤵
- Executes dropped EXE
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"45⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"46⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"47⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"48⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"49⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"50⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"51⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"52⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"53⤵
- Executes dropped EXE
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"54⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"55⤵
- Executes dropped EXE
PID:3228 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"56⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"57⤵
- Executes dropped EXE
PID:756 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"58⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"59⤵
- Executes dropped EXE
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"60⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"61⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"62⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"63⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"64⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"65⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"66⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"67⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"68⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"69⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"70⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"71⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"72⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"73⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"74⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"75⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"76⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"77⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"78⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"79⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"80⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"81⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"82⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"83⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"84⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"85⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"86⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"87⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"88⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"89⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"90⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"91⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"92⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"93⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"94⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"95⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"96⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"97⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"98⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"99⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"C:\Users\Admin\AppData\Local\Temp\6E2B.tmp"100⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"101⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"102⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"103⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"104⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"105⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"106⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"107⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"108⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"109⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"110⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"111⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"112⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"113⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"114⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"115⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"116⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"117⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"118⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"119⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"120⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"121⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"122⤵PID:2752
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-