Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09-04-2024 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe
-
Size
486KB
-
MD5
29af4b2a038577970e00dd43b3859286
-
SHA1
7b6137179b820ed76f342e9a287a14dc575fcd8b
-
SHA256
7393daa2bcb693f8112224519c3ba4f6ed13fba15789e54794cfde2ee9179a02
-
SHA512
efdcbc49c71c4a0bf00f55528d6598c6c8ee7b9a0df8bc5d67bfe13b8ae868ffea4b09dce09c35ad5d27871549077592652a2a3d1f5e5810846f128979f72c55
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7kRiNFimtq7Ahm45Dd/PH5H2nZfGq1jB7VaZQ:UU5rCOTeiDeiXimtq74m4pd/OGs7vNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4364 6580.tmp 1620 663C.tmp 3128 66D8.tmp 1344 67A3.tmp 3192 683F.tmp 876 691A.tmp 4192 69B6.tmp 2316 6A62.tmp 3100 6AEF.tmp 2628 6B8B.tmp 4984 6C27.tmp 2164 6CB4.tmp 3996 6D6F.tmp 1340 6DFC.tmp 4148 6EB8.tmp 1552 6F44.tmp 1580 6FD1.tmp 4452 707D.tmp 2796 7109.tmp 5056 71C5.tmp 4560 7261.tmp 3524 739A.tmp 4504 7465.tmp 540 7530.tmp 2552 75BC.tmp 4220 7649.tmp 4892 76D6.tmp 1764 7782.tmp 3816 788B.tmp 4416 7947.tmp 4556 79F3.tmp 4304 7A8F.tmp 4792 7B1B.tmp 4456 7BA8.tmp 2028 7C25.tmp 4400 7CB2.tmp 4348 7D4E.tmp 2612 7DDB.tmp 4364 7E58.tmp 4248 7EF4.tmp 3172 7F71.tmp 3184 802C.tmp 4960 809A.tmp 2032 8136.tmp 3000 81B3.tmp 536 8240.tmp 3928 82DC.tmp 4656 8388.tmp 1116 8424.tmp 4944 84B1.tmp 3284 853D.tmp 2548 85D9.tmp 1652 8676.tmp 3312 8712.tmp 2996 878F.tmp 4612 882B.tmp 5000 88A8.tmp 1164 8916.tmp 4308 8993.tmp 1656 8A00.tmp 4752 8A8D.tmp 1976 8B19.tmp 3616 8BB5.tmp 4452 8C52.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4512 wrote to memory of 4364 4512 2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe 86 PID 4512 wrote to memory of 4364 4512 2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe 86 PID 4512 wrote to memory of 4364 4512 2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe 86 PID 4364 wrote to memory of 1620 4364 6580.tmp 87 PID 4364 wrote to memory of 1620 4364 6580.tmp 87 PID 4364 wrote to memory of 1620 4364 6580.tmp 87 PID 1620 wrote to memory of 3128 1620 663C.tmp 88 PID 1620 wrote to memory of 3128 1620 663C.tmp 88 PID 1620 wrote to memory of 3128 1620 663C.tmp 88 PID 3128 wrote to memory of 1344 3128 66D8.tmp 90 PID 3128 wrote to memory of 1344 3128 66D8.tmp 90 PID 3128 wrote to memory of 1344 3128 66D8.tmp 90 PID 1344 wrote to memory of 3192 1344 67A3.tmp 91 PID 1344 wrote to memory of 3192 1344 67A3.tmp 91 PID 1344 wrote to memory of 3192 1344 67A3.tmp 91 PID 3192 wrote to memory of 876 3192 683F.tmp 93 PID 3192 wrote to memory of 876 3192 683F.tmp 93 PID 3192 wrote to memory of 876 3192 683F.tmp 93 PID 876 wrote to memory of 4192 876 691A.tmp 94 PID 876 wrote to memory of 4192 876 691A.tmp 94 PID 876 wrote to memory of 4192 876 691A.tmp 94 PID 4192 wrote to memory of 2316 4192 69B6.tmp 95 PID 4192 wrote to memory of 2316 4192 69B6.tmp 95 PID 4192 wrote to memory of 2316 4192 69B6.tmp 95 PID 2316 wrote to memory of 3100 2316 6A62.tmp 96 PID 2316 wrote to memory of 3100 2316 6A62.tmp 96 PID 2316 wrote to memory of 3100 2316 6A62.tmp 96 PID 3100 wrote to memory of 2628 3100 6AEF.tmp 97 PID 3100 wrote to memory of 2628 3100 6AEF.tmp 97 PID 3100 wrote to memory of 2628 3100 6AEF.tmp 97 PID 2628 wrote to memory of 4984 2628 6B8B.tmp 98 PID 2628 wrote to memory of 4984 2628 6B8B.tmp 98 PID 2628 wrote to memory of 4984 2628 6B8B.tmp 98 PID 4984 wrote to memory of 2164 4984 6C27.tmp 99 PID 4984 wrote to memory of 2164 4984 6C27.tmp 99 PID 4984 wrote to memory of 2164 4984 6C27.tmp 99 PID 2164 wrote to memory of 3996 2164 6CB4.tmp 100 PID 2164 wrote to memory of 3996 2164 6CB4.tmp 100 PID 2164 wrote to memory of 3996 2164 6CB4.tmp 100 PID 3996 wrote to memory of 1340 3996 6D6F.tmp 101 PID 3996 wrote to memory of 1340 3996 6D6F.tmp 101 PID 3996 wrote to memory of 1340 3996 6D6F.tmp 101 PID 1340 wrote to memory of 4148 1340 6DFC.tmp 102 PID 1340 wrote to memory of 4148 1340 6DFC.tmp 102 PID 1340 wrote to memory of 4148 1340 6DFC.tmp 102 PID 4148 wrote to memory of 1552 4148 6EB8.tmp 103 PID 4148 wrote to memory of 1552 4148 6EB8.tmp 103 PID 4148 wrote to memory of 1552 4148 6EB8.tmp 103 PID 1552 wrote to memory of 1580 1552 6F44.tmp 104 PID 1552 wrote to memory of 1580 1552 6F44.tmp 104 PID 1552 wrote to memory of 1580 1552 6F44.tmp 104 PID 1580 wrote to memory of 4452 1580 6FD1.tmp 107 PID 1580 wrote to memory of 4452 1580 6FD1.tmp 107 PID 1580 wrote to memory of 4452 1580 6FD1.tmp 107 PID 4452 wrote to memory of 2796 4452 707D.tmp 108 PID 4452 wrote to memory of 2796 4452 707D.tmp 108 PID 4452 wrote to memory of 2796 4452 707D.tmp 108 PID 2796 wrote to memory of 5056 2796 7109.tmp 109 PID 2796 wrote to memory of 5056 2796 7109.tmp 109 PID 2796 wrote to memory of 5056 2796 7109.tmp 109 PID 5056 wrote to memory of 4560 5056 71C5.tmp 110 PID 5056 wrote to memory of 4560 5056 71C5.tmp 110 PID 5056 wrote to memory of 4560 5056 71C5.tmp 110 PID 4560 wrote to memory of 3524 4560 7261.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-08_29af4b2a038577970e00dd43b3859286_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\739A.tmp"C:\Users\Admin\AppData\Local\Temp\739A.tmp"23⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"24⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"25⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"26⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"27⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"28⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"29⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\788B.tmp"C:\Users\Admin\AppData\Local\Temp\788B.tmp"30⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"31⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"32⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"33⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"34⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"C:\Users\Admin\AppData\Local\Temp\7BA8.tmp"35⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"36⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"C:\Users\Admin\AppData\Local\Temp\7CB2.tmp"37⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"38⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"C:\Users\Admin\AppData\Local\Temp\7DDB.tmp"39⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"40⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"C:\Users\Admin\AppData\Local\Temp\7EF4.tmp"41⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"42⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\802C.tmp"C:\Users\Admin\AppData\Local\Temp\802C.tmp"43⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"44⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"45⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"46⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"47⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"48⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"49⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"50⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"51⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\853D.tmp"C:\Users\Admin\AppData\Local\Temp\853D.tmp"52⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"53⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"54⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"55⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"56⤵
- Executes dropped EXE
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"57⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\88A8.tmp"C:\Users\Admin\AppData\Local\Temp\88A8.tmp"58⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\8916.tmp"C:\Users\Admin\AppData\Local\Temp\8916.tmp"59⤵
- Executes dropped EXE
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"60⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"61⤵
- Executes dropped EXE
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"C:\Users\Admin\AppData\Local\Temp\8A8D.tmp"62⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\8B19.tmp"C:\Users\Admin\AppData\Local\Temp\8B19.tmp"63⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"64⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"65⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"66⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"67⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"68⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"69⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"70⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"C:\Users\Admin\AppData\Local\Temp\8F4F.tmp"71⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"C:\Users\Admin\AppData\Local\Temp\8FCC.tmp"72⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"73⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"74⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\9153.tmp"C:\Users\Admin\AppData\Local\Temp\9153.tmp"75⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"76⤵PID:4416
-
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"77⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"78⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\9366.tmp"C:\Users\Admin\AppData\Local\Temp\9366.tmp"79⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\93E3.tmp"C:\Users\Admin\AppData\Local\Temp\93E3.tmp"80⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"81⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\951C.tmp"C:\Users\Admin\AppData\Local\Temp\951C.tmp"82⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"83⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"84⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"85⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"86⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"87⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"88⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"89⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"90⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"91⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\99B0.tmp"C:\Users\Admin\AppData\Local\Temp\99B0.tmp"92⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"93⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"94⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\9B17.tmp"C:\Users\Admin\AppData\Local\Temp\9B17.tmp"95⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"96⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"97⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"98⤵PID:3284
-
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"99⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"100⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"101⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"102⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"C:\Users\Admin\AppData\Local\Temp\9F6C.tmp"103⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"104⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"105⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"106⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"107⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"108⤵PID:5048
-
C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"C:\Users\Admin\AppData\Local\Temp\A2F7.tmp"109⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"110⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"111⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"112⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"113⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"114⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\A642.tmp"C:\Users\Admin\AppData\Local\Temp\A642.tmp"115⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"116⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"117⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"118⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"119⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"120⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"C:\Users\Admin\AppData\Local\Temp\AA0B.tmp"121⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"122⤵PID:3840
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-