Analysis
-
max time kernel
151s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
11/02/2024, 15:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe
-
Size
486KB
-
MD5
ab18e7639a99f8b3de7e448ad3539c26
-
SHA1
b4cb5338e6f10f1ae8689e8fff36b9e799d29cd3
-
SHA256
8b71b2b8bf895d61ba251d7d9b57d6a8b810bc43eccb9bbfef189916a0bf56a8
-
SHA512
e4e3d8e9990003fc1501975a2314f9a1771432a13527c8603e9aa07bc8f6349090abb97aed26babca00f8d84f9154514330fd0832463cfbd5ae78ee6209544ad
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7NSOEebPd484WBdVABx4IZPhrxQWza+tEvfVa:/U5rCOTeiDfJzSiXGT1YiEXKNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4620 FCDE.tmp 1076 FE26.tmp 3276 FF01.tmp 4196 B.tmp 4640 B7.tmp 3084 162.tmp 2596 21E.tmp 2968 77D.tmp 5020 8A6.tmp 4476 932.tmp 4592 A6B.tmp 1384 B55.tmp 1956 C30.tmp 2780 CEC.tmp 880 DA7.tmp 4388 E53.tmp 5116 EFF.tmp 1120 1018.tmp 4496 10E3.tmp 1272 11AE.tmp 5080 125A.tmp 4648 12D7.tmp 2528 1373.tmp 380 1400.tmp 2424 14CB.tmp 2256 1577.tmp 4260 1623.tmp 536 16EE.tmp 4852 17B9.tmp 1496 1875.tmp 1596 1940.tmp 412 19DC.tmp 4660 1A88.tmp 2308 1B34.tmp 3592 1BE0.tmp 1616 1C6C.tmp 1216 1D09.tmp 4828 1DB4.tmp 228 1E41.tmp 456 1EDD.tmp 4220 1F7A.tmp 1972 1FF7.tmp 1936 20A2.tmp 3156 213F.tmp 2660 21CB.tmp 5060 2287.tmp 4060 2333.tmp 4500 23B0.tmp 892 244C.tmp 1488 24E8.tmp 1644 25A4.tmp 1404 2640.tmp 4300 26CD.tmp 448 2769.tmp 4800 27E6.tmp 4948 2872.tmp 1388 292E.tmp 3576 29BB.tmp 4640 2A57.tmp 4632 2AE3.tmp 3860 2B70.tmp 3084 2C1C.tmp 4248 2CC8.tmp 3348 2D35.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2580 wrote to memory of 4620 2580 2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe 83 PID 2580 wrote to memory of 4620 2580 2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe 83 PID 2580 wrote to memory of 4620 2580 2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe 83 PID 4620 wrote to memory of 1076 4620 FCDE.tmp 84 PID 4620 wrote to memory of 1076 4620 FCDE.tmp 84 PID 4620 wrote to memory of 1076 4620 FCDE.tmp 84 PID 1076 wrote to memory of 3276 1076 FE26.tmp 85 PID 1076 wrote to memory of 3276 1076 FE26.tmp 85 PID 1076 wrote to memory of 3276 1076 FE26.tmp 85 PID 3276 wrote to memory of 4196 3276 FF01.tmp 86 PID 3276 wrote to memory of 4196 3276 FF01.tmp 86 PID 3276 wrote to memory of 4196 3276 FF01.tmp 86 PID 4196 wrote to memory of 4640 4196 B.tmp 87 PID 4196 wrote to memory of 4640 4196 B.tmp 87 PID 4196 wrote to memory of 4640 4196 B.tmp 87 PID 4640 wrote to memory of 3084 4640 B7.tmp 88 PID 4640 wrote to memory of 3084 4640 B7.tmp 88 PID 4640 wrote to memory of 3084 4640 B7.tmp 88 PID 3084 wrote to memory of 2596 3084 162.tmp 89 PID 3084 wrote to memory of 2596 3084 162.tmp 89 PID 3084 wrote to memory of 2596 3084 162.tmp 89 PID 2596 wrote to memory of 2968 2596 21E.tmp 90 PID 2596 wrote to memory of 2968 2596 21E.tmp 90 PID 2596 wrote to memory of 2968 2596 21E.tmp 90 PID 2968 wrote to memory of 5020 2968 77D.tmp 91 PID 2968 wrote to memory of 5020 2968 77D.tmp 91 PID 2968 wrote to memory of 5020 2968 77D.tmp 91 PID 5020 wrote to memory of 4476 5020 8A6.tmp 92 PID 5020 wrote to memory of 4476 5020 8A6.tmp 92 PID 5020 wrote to memory of 4476 5020 8A6.tmp 92 PID 4476 wrote to memory of 4592 4476 932.tmp 93 PID 4476 wrote to memory of 4592 4476 932.tmp 93 PID 4476 wrote to memory of 4592 4476 932.tmp 93 PID 4592 wrote to memory of 1384 4592 A6B.tmp 94 PID 4592 wrote to memory of 1384 4592 A6B.tmp 94 PID 4592 wrote to memory of 1384 4592 A6B.tmp 94 PID 1384 wrote to memory of 1956 1384 B55.tmp 95 PID 1384 wrote to memory of 1956 1384 B55.tmp 95 PID 1384 wrote to memory of 1956 1384 B55.tmp 95 PID 1956 wrote to memory of 2780 1956 C30.tmp 96 PID 1956 wrote to memory of 2780 1956 C30.tmp 96 PID 1956 wrote to memory of 2780 1956 C30.tmp 96 PID 2780 wrote to memory of 880 2780 CEC.tmp 97 PID 2780 wrote to memory of 880 2780 CEC.tmp 97 PID 2780 wrote to memory of 880 2780 CEC.tmp 97 PID 880 wrote to memory of 4388 880 DA7.tmp 98 PID 880 wrote to memory of 4388 880 DA7.tmp 98 PID 880 wrote to memory of 4388 880 DA7.tmp 98 PID 4388 wrote to memory of 5116 4388 E53.tmp 99 PID 4388 wrote to memory of 5116 4388 E53.tmp 99 PID 4388 wrote to memory of 5116 4388 E53.tmp 99 PID 5116 wrote to memory of 1120 5116 EFF.tmp 100 PID 5116 wrote to memory of 1120 5116 EFF.tmp 100 PID 5116 wrote to memory of 1120 5116 EFF.tmp 100 PID 1120 wrote to memory of 4496 1120 1018.tmp 101 PID 1120 wrote to memory of 4496 1120 1018.tmp 101 PID 1120 wrote to memory of 4496 1120 1018.tmp 101 PID 4496 wrote to memory of 1272 4496 10E3.tmp 102 PID 4496 wrote to memory of 1272 4496 10E3.tmp 102 PID 4496 wrote to memory of 1272 4496 10E3.tmp 102 PID 1272 wrote to memory of 5080 1272 11AE.tmp 103 PID 1272 wrote to memory of 5080 1272 11AE.tmp 103 PID 1272 wrote to memory of 5080 1272 11AE.tmp 103 PID 5080 wrote to memory of 4648 5080 125A.tmp 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_ab18e7639a99f8b3de7e448ad3539c26_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"C:\Users\Admin\AppData\Local\Temp\FCDE.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\FE26.tmp"C:\Users\Admin\AppData\Local\Temp\FE26.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\FF01.tmp"C:\Users\Admin\AppData\Local\Temp\FF01.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\B.tmp"C:\Users\Admin\AppData\Local\Temp\B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\8A6.tmp"C:\Users\Admin\AppData\Local\Temp\8A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\A6B.tmp"C:\Users\Admin\AppData\Local\Temp\A6B.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\B55.tmp"C:\Users\Admin\AppData\Local\Temp\B55.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Users\Admin\AppData\Local\Temp\E53.tmp"C:\Users\Admin\AppData\Local\Temp\E53.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\EFF.tmp"C:\Users\Admin\AppData\Local\Temp\EFF.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\1018.tmp"C:\Users\Admin\AppData\Local\Temp\1018.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\11AE.tmp"C:\Users\Admin\AppData\Local\Temp\11AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\12D7.tmp"C:\Users\Admin\AppData\Local\Temp\12D7.tmp"23⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"24⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"25⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\14CB.tmp"C:\Users\Admin\AppData\Local\Temp\14CB.tmp"26⤵
- Executes dropped EXE
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"27⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\1623.tmp"C:\Users\Admin\AppData\Local\Temp\1623.tmp"28⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\16EE.tmp"C:\Users\Admin\AppData\Local\Temp\16EE.tmp"29⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"30⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\1875.tmp"C:\Users\Admin\AppData\Local\Temp\1875.tmp"31⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"32⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"33⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\1A88.tmp"C:\Users\Admin\AppData\Local\Temp\1A88.tmp"34⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\1B34.tmp"C:\Users\Admin\AppData\Local\Temp\1B34.tmp"35⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"36⤵
- Executes dropped EXE
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"37⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\1D09.tmp"C:\Users\Admin\AppData\Local\Temp\1D09.tmp"38⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"C:\Users\Admin\AppData\Local\Temp\1DB4.tmp"39⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\1E41.tmp"C:\Users\Admin\AppData\Local\Temp\1E41.tmp"40⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"C:\Users\Admin\AppData\Local\Temp\1EDD.tmp"41⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"42⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"C:\Users\Admin\AppData\Local\Temp\1FF7.tmp"43⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"44⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\213F.tmp"C:\Users\Admin\AppData\Local\Temp\213F.tmp"45⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\21CB.tmp"C:\Users\Admin\AppData\Local\Temp\21CB.tmp"46⤵
- Executes dropped EXE
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\2287.tmp"C:\Users\Admin\AppData\Local\Temp\2287.tmp"47⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"48⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\23B0.tmp"C:\Users\Admin\AppData\Local\Temp\23B0.tmp"49⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"50⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\24E8.tmp"C:\Users\Admin\AppData\Local\Temp\24E8.tmp"51⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\25A4.tmp"C:\Users\Admin\AppData\Local\Temp\25A4.tmp"52⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\2640.tmp"C:\Users\Admin\AppData\Local\Temp\2640.tmp"53⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\26CD.tmp"C:\Users\Admin\AppData\Local\Temp\26CD.tmp"54⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\2769.tmp"C:\Users\Admin\AppData\Local\Temp\2769.tmp"55⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\27E6.tmp"C:\Users\Admin\AppData\Local\Temp\27E6.tmp"56⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"57⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\292E.tmp"C:\Users\Admin\AppData\Local\Temp\292E.tmp"58⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\29BB.tmp"C:\Users\Admin\AppData\Local\Temp\29BB.tmp"59⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\2A57.tmp"C:\Users\Admin\AppData\Local\Temp\2A57.tmp"60⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"C:\Users\Admin\AppData\Local\Temp\2AE3.tmp"61⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\2B70.tmp"C:\Users\Admin\AppData\Local\Temp\2B70.tmp"62⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"C:\Users\Admin\AppData\Local\Temp\2C1C.tmp"63⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"C:\Users\Admin\AppData\Local\Temp\2CC8.tmp"64⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"65⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"C:\Users\Admin\AppData\Local\Temp\2DA3.tmp"66⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"67⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"68⤵PID:4236
-
C:\Users\Admin\AppData\Local\Temp\2F68.tmp"C:\Users\Admin\AppData\Local\Temp\2F68.tmp"69⤵PID:2436
-
C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"C:\Users\Admin\AppData\Local\Temp\2FF4.tmp"70⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"71⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\311D.tmp"C:\Users\Admin\AppData\Local\Temp\311D.tmp"72⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"73⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"74⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\32E2.tmp"C:\Users\Admin\AppData\Local\Temp\32E2.tmp"75⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"76⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"77⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"78⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\3544.tmp"C:\Users\Admin\AppData\Local\Temp\3544.tmp"79⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\360F.tmp"C:\Users\Admin\AppData\Local\Temp\360F.tmp"80⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"81⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"82⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"83⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\3832.tmp"C:\Users\Admin\AppData\Local\Temp\3832.tmp"84⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\38DE.tmp"C:\Users\Admin\AppData\Local\Temp\38DE.tmp"85⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\3999.tmp"C:\Users\Admin\AppData\Local\Temp\3999.tmp"86⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"87⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"C:\Users\Admin\AppData\Local\Temp\3AE1.tmp"88⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"C:\Users\Admin\AppData\Local\Temp\3B7D.tmp"89⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\3C39.tmp"C:\Users\Admin\AppData\Local\Temp\3C39.tmp"90⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"C:\Users\Admin\AppData\Local\Temp\3CC6.tmp"91⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\3D71.tmp"C:\Users\Admin\AppData\Local\Temp\3D71.tmp"92⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"C:\Users\Admin\AppData\Local\Temp\3E0E.tmp"93⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"C:\Users\Admin\AppData\Local\Temp\3E8B.tmp"94⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\3F08.tmp"C:\Users\Admin\AppData\Local\Temp\3F08.tmp"95⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"96⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"97⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\40BD.tmp"C:\Users\Admin\AppData\Local\Temp\40BD.tmp"98⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\4169.tmp"C:\Users\Admin\AppData\Local\Temp\4169.tmp"99⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp"100⤵PID:3328
-
C:\Users\Admin\AppData\Local\Temp\4292.tmp"C:\Users\Admin\AppData\Local\Temp\4292.tmp"101⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\432E.tmp"C:\Users\Admin\AppData\Local\Temp\432E.tmp"102⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\43EA.tmp"C:\Users\Admin\AppData\Local\Temp\43EA.tmp"103⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\4476.tmp"C:\Users\Admin\AppData\Local\Temp\4476.tmp"104⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\4513.tmp"C:\Users\Admin\AppData\Local\Temp\4513.tmp"105⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"106⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\4764.tmp"C:\Users\Admin\AppData\Local\Temp\4764.tmp"107⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\47E1.tmp"C:\Users\Admin\AppData\Local\Temp\47E1.tmp"108⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"109⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\48CC.tmp"C:\Users\Admin\AppData\Local\Temp\48CC.tmp"110⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\4949.tmp"C:\Users\Admin\AppData\Local\Temp\4949.tmp"111⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\49E5.tmp"C:\Users\Admin\AppData\Local\Temp\49E5.tmp"112⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\4A72.tmp"C:\Users\Admin\AppData\Local\Temp\4A72.tmp"113⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"C:\Users\Admin\AppData\Local\Temp\4B3D.tmp"114⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"C:\Users\Admin\AppData\Local\Temp\4BC9.tmp"115⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\4C46.tmp"C:\Users\Admin\AppData\Local\Temp\4C46.tmp"116⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"C:\Users\Admin\AppData\Local\Temp\4CC3.tmp"117⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\4D40.tmp"C:\Users\Admin\AppData\Local\Temp\4D40.tmp"118⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"C:\Users\Admin\AppData\Local\Temp\4DBD.tmp"119⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"C:\Users\Admin\AppData\Local\Temp\4E5A.tmp"120⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"C:\Users\Admin\AppData\Local\Temp\4ED7.tmp"121⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\4F73.tmp"C:\Users\Admin\AppData\Local\Temp\4F73.tmp"122⤵PID:3524
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-