Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 06:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe
-
Size
536KB
-
MD5
7f447ce89c4eab007d80d2c86b4bfc22
-
SHA1
ab17a879025ef32348477a15bda8435f9235f4fd
-
SHA256
d14bfe574efcbadd94b13d585275b46b49b4d149892cd72fd2c4bba2805c0e42
-
SHA512
aea404166b04348245167548472e0dac0f71ee73f0435abb4248d7e8d8a7e39a61194ac053e1782e81fa4ba390dbe7a1b7c8d90cf6944633ec8d3710ee8d91eb
-
SSDEEP
12288:wU5rCOTeiUDzmpma8+fSY5GFN1z4VBB+7d+IZxVJ0ZT9:wUQOJUDzmpZfSrC7B+YIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2656 512D.tmp 2248 5275.tmp 4276 5331.tmp 1316 53FC.tmp 1332 5505.tmp 3644 55E0.tmp 1928 56DA.tmp 5028 57A5.tmp 2764 5870.tmp 1596 598A.tmp 4452 5B30.tmp 4944 5BFB.tmp 2080 5CD5.tmp 1048 5D81.tmp 1452 5E6C.tmp 1796 5F46.tmp 1560 6050.tmp 1652 615A.tmp 4768 6254.tmp 4644 632E.tmp 3560 6409.tmp 3308 64F4.tmp 3616 65AF.tmp 712 666B.tmp 5060 6765.tmp 4232 6820.tmp 1816 68DC.tmp 1512 69E5.tmp 1732 6AD0.tmp 436 6BD9.tmp 3628 6CB4.tmp 4676 6DCD.tmp 2636 6EB8.tmp 3360 6F44.tmp 2344 6FB2.tmp 2252 703E.tmp 1104 70CB.tmp 412 7177.tmp 1204 71E4.tmp 1620 7280.tmp 2352 72FD.tmp 3312 73A9.tmp 376 7445.tmp 1372 74E2.tmp 3756 755F.tmp 3280 760B.tmp 3524 76D6.tmp 2068 7772.tmp 4068 781E.tmp 4636 786C.tmp 3840 78BA.tmp 2488 7937.tmp 4160 7985.tmp 4884 7A02.tmp 2568 7A60.tmp 1464 7AAE.tmp 812 7AFC.tmp 4380 7B79.tmp 4700 7BC7.tmp 5048 7C25.tmp 2648 7C83.tmp 1732 7CD1.tmp 2220 7D1F.tmp 2196 7D6D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2656 1212 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 83 PID 1212 wrote to memory of 2656 1212 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 83 PID 1212 wrote to memory of 2656 1212 2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe 83 PID 2656 wrote to memory of 2248 2656 512D.tmp 84 PID 2656 wrote to memory of 2248 2656 512D.tmp 84 PID 2656 wrote to memory of 2248 2656 512D.tmp 84 PID 2248 wrote to memory of 4276 2248 5275.tmp 85 PID 2248 wrote to memory of 4276 2248 5275.tmp 85 PID 2248 wrote to memory of 4276 2248 5275.tmp 85 PID 4276 wrote to memory of 1316 4276 5331.tmp 86 PID 4276 wrote to memory of 1316 4276 5331.tmp 86 PID 4276 wrote to memory of 1316 4276 5331.tmp 86 PID 1316 wrote to memory of 1332 1316 53FC.tmp 87 PID 1316 wrote to memory of 1332 1316 53FC.tmp 87 PID 1316 wrote to memory of 1332 1316 53FC.tmp 87 PID 1332 wrote to memory of 3644 1332 5505.tmp 88 PID 1332 wrote to memory of 3644 1332 5505.tmp 88 PID 1332 wrote to memory of 3644 1332 5505.tmp 88 PID 3644 wrote to memory of 1928 3644 55E0.tmp 89 PID 3644 wrote to memory of 1928 3644 55E0.tmp 89 PID 3644 wrote to memory of 1928 3644 55E0.tmp 89 PID 1928 wrote to memory of 5028 1928 56DA.tmp 90 PID 1928 wrote to memory of 5028 1928 56DA.tmp 90 PID 1928 wrote to memory of 5028 1928 56DA.tmp 90 PID 5028 wrote to memory of 2764 5028 57A5.tmp 92 PID 5028 wrote to memory of 2764 5028 57A5.tmp 92 PID 5028 wrote to memory of 2764 5028 57A5.tmp 92 PID 2764 wrote to memory of 1596 2764 5870.tmp 94 PID 2764 wrote to memory of 1596 2764 5870.tmp 94 PID 2764 wrote to memory of 1596 2764 5870.tmp 94 PID 1596 wrote to memory of 4452 1596 598A.tmp 96 PID 1596 wrote to memory of 4452 1596 598A.tmp 96 PID 1596 wrote to memory of 4452 1596 598A.tmp 96 PID 4452 wrote to memory of 4944 4452 5B30.tmp 97 PID 4452 wrote to memory of 4944 4452 5B30.tmp 97 PID 4452 wrote to memory of 4944 4452 5B30.tmp 97 PID 4944 wrote to memory of 2080 4944 5BFB.tmp 98 PID 4944 wrote to memory of 2080 4944 5BFB.tmp 98 PID 4944 wrote to memory of 2080 4944 5BFB.tmp 98 PID 2080 wrote to memory of 1048 2080 5CD5.tmp 99 PID 2080 wrote to memory of 1048 2080 5CD5.tmp 99 PID 2080 wrote to memory of 1048 2080 5CD5.tmp 99 PID 1048 wrote to memory of 1452 1048 5D81.tmp 100 PID 1048 wrote to memory of 1452 1048 5D81.tmp 100 PID 1048 wrote to memory of 1452 1048 5D81.tmp 100 PID 1452 wrote to memory of 1796 1452 5E6C.tmp 101 PID 1452 wrote to memory of 1796 1452 5E6C.tmp 101 PID 1452 wrote to memory of 1796 1452 5E6C.tmp 101 PID 1796 wrote to memory of 1560 1796 5F46.tmp 102 PID 1796 wrote to memory of 1560 1796 5F46.tmp 102 PID 1796 wrote to memory of 1560 1796 5F46.tmp 102 PID 1560 wrote to memory of 1652 1560 6050.tmp 103 PID 1560 wrote to memory of 1652 1560 6050.tmp 103 PID 1560 wrote to memory of 1652 1560 6050.tmp 103 PID 1652 wrote to memory of 4768 1652 615A.tmp 104 PID 1652 wrote to memory of 4768 1652 615A.tmp 104 PID 1652 wrote to memory of 4768 1652 615A.tmp 104 PID 4768 wrote to memory of 4644 4768 6254.tmp 107 PID 4768 wrote to memory of 4644 4768 6254.tmp 107 PID 4768 wrote to memory of 4644 4768 6254.tmp 107 PID 4644 wrote to memory of 3560 4644 632E.tmp 108 PID 4644 wrote to memory of 3560 4644 632E.tmp 108 PID 4644 wrote to memory of 3560 4644 632E.tmp 108 PID 3560 wrote to memory of 3308 3560 6409.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_7f447ce89c4eab007d80d2c86b4bfc22_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"23⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"24⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"25⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"26⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"27⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"28⤵
- Executes dropped EXE
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"29⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"30⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"31⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"32⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"33⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"34⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"35⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"36⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"37⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"38⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"39⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"40⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"41⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"42⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"43⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"44⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"45⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"46⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"47⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"48⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"49⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"50⤵
- Executes dropped EXE
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"51⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"52⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\7937.tmp"C:\Users\Admin\AppData\Local\Temp\7937.tmp"53⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"54⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\7A02.tmp"C:\Users\Admin\AppData\Local\Temp\7A02.tmp"55⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\7A60.tmp"C:\Users\Admin\AppData\Local\Temp\7A60.tmp"56⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"57⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"58⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"59⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"60⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\7C25.tmp"C:\Users\Admin\AppData\Local\Temp\7C25.tmp"61⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\7C83.tmp"C:\Users\Admin\AppData\Local\Temp\7C83.tmp"62⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"63⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"C:\Users\Admin\AppData\Local\Temp\7D1F.tmp"64⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"65⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"C:\Users\Admin\AppData\Local\Temp\7DCB.tmp"66⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\7E19.tmp"C:\Users\Admin\AppData\Local\Temp\7E19.tmp"67⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\7E86.tmp"C:\Users\Admin\AppData\Local\Temp\7E86.tmp"68⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"69⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"70⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"71⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"72⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"73⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\809A.tmp"C:\Users\Admin\AppData\Local\Temp\809A.tmp"74⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"75⤵PID:3528
-
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"76⤵PID:2044
-
C:\Users\Admin\AppData\Local\Temp\81A3.tmp"C:\Users\Admin\AppData\Local\Temp\81A3.tmp"77⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"78⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"79⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"80⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\830B.tmp"C:\Users\Admin\AppData\Local\Temp\830B.tmp"81⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"82⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"83⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\83F5.tmp"C:\Users\Admin\AppData\Local\Temp\83F5.tmp"84⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\8453.tmp"C:\Users\Admin\AppData\Local\Temp\8453.tmp"85⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"86⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\850E.tmp"C:\Users\Admin\AppData\Local\Temp\850E.tmp"87⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\855C.tmp"C:\Users\Admin\AppData\Local\Temp\855C.tmp"88⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"89⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\8608.tmp"C:\Users\Admin\AppData\Local\Temp\8608.tmp"90⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\8656.tmp"C:\Users\Admin\AppData\Local\Temp\8656.tmp"91⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"92⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"93⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\8760.tmp"C:\Users\Admin\AppData\Local\Temp\8760.tmp"94⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"95⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"96⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\886A.tmp"C:\Users\Admin\AppData\Local\Temp\886A.tmp"97⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"98⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"99⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"100⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\89D1.tmp"C:\Users\Admin\AppData\Local\Temp\89D1.tmp"101⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"C:\Users\Admin\AppData\Local\Temp\8A1F.tmp"102⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"C:\Users\Admin\AppData\Local\Temp\8A6D.tmp"103⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"104⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"105⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\8B58.tmp"C:\Users\Admin\AppData\Local\Temp\8B58.tmp"106⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"C:\Users\Admin\AppData\Local\Temp\8BA6.tmp"107⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"C:\Users\Admin\AppData\Local\Temp\8BF4.tmp"108⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"109⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"110⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"111⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"C:\Users\Admin\AppData\Local\Temp\8D5B.tmp"112⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"C:\Users\Admin\AppData\Local\Temp\8DA9.tmp"113⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\8E17.tmp"C:\Users\Admin\AppData\Local\Temp\8E17.tmp"114⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\8E84.tmp"C:\Users\Admin\AppData\Local\Temp\8E84.tmp"115⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"116⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"117⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"118⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"119⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\900B.tmp"C:\Users\Admin\AppData\Local\Temp\900B.tmp"120⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"121⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"122⤵PID:3616
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-