Analysis
-
max time kernel
150s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 03:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe
-
Size
712KB
-
MD5
7f754a3d982fe24d5e2156941539e82d
-
SHA1
ecefe5ae1d5e4400f54141826900d8815da5c010
-
SHA256
b355ac2c662550ef82ddbd06451b2fbcf69b1e5328af02dab45e6eba7835e0fc
-
SHA512
2ce69f95c5a039181e2787707401978efca8d35c6dab2ac755ab247c600b122b66de69d4c12c7275b026d3afb0596f4b4fb54eadd91a1f14153aead76917fbc7
-
SSDEEP
12288:FU5rCOTeiDjg3F4gapvUHLbkqDacoNZdCvq5TJLCvY90D8/LVBlVk736Y79GWzN0:FUQOJDjtpvELbvacoNnCvq5TJLCvY90E
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3644 74A3.tmp 4840 755F.tmp 1152 762A.tmp 4060 76C6.tmp 2092 7753.tmp 3092 77DF.tmp 2632 784D.tmp 4984 7908.tmp 3140 79C4.tmp 4460 7A50.tmp 3396 7ACD.tmp 3264 7BF6.tmp 4792 7C54.tmp 3216 7CD1.tmp 468 7D3E.tmp 1636 7D9C.tmp 3716 7E29.tmp 3392 7E96.tmp 4988 7EE4.tmp 3684 7F80.tmp 2848 7FFD.tmp 3712 80B9.tmp 832 8136.tmp 920 8194.tmp 1828 81F1.tmp 3888 828E.tmp 1304 82FB.tmp 2984 8388.tmp 2420 8414.tmp 3300 84DF.tmp 3852 854D.tmp 1820 85BA.tmp 4304 86A5.tmp 4876 86F3.tmp 4400 8741.tmp 4376 87AE.tmp 412 880C.tmp 2596 8879.tmp 3576 88D7.tmp 2924 8925.tmp 4600 8983.tmp 888 89F0.tmp 1480 8A5E.tmp 512 8ABB.tmp 904 8B0A.tmp 1512 8B67.tmp 4060 8BD5.tmp 3952 8C23.tmp 2092 8C81.tmp 3696 8CCF.tmp 2636 8D3C.tmp 556 8D9A.tmp 3676 8E07.tmp 4432 8E75.tmp 2360 8ED2.tmp 3140 8F30.tmp 4460 8F8E.tmp 3536 8FEC.tmp 4296 9049.tmp 4316 90A7.tmp 4792 9114.tmp 3216 9182.tmp 4616 91E0.tmp 4448 924D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1164 wrote to memory of 3644 1164 2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe 85 PID 1164 wrote to memory of 3644 1164 2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe 85 PID 1164 wrote to memory of 3644 1164 2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe 85 PID 3644 wrote to memory of 4840 3644 74A3.tmp 86 PID 3644 wrote to memory of 4840 3644 74A3.tmp 86 PID 3644 wrote to memory of 4840 3644 74A3.tmp 86 PID 4840 wrote to memory of 1152 4840 755F.tmp 88 PID 4840 wrote to memory of 1152 4840 755F.tmp 88 PID 4840 wrote to memory of 1152 4840 755F.tmp 88 PID 1152 wrote to memory of 4060 1152 762A.tmp 90 PID 1152 wrote to memory of 4060 1152 762A.tmp 90 PID 1152 wrote to memory of 4060 1152 762A.tmp 90 PID 4060 wrote to memory of 2092 4060 76C6.tmp 91 PID 4060 wrote to memory of 2092 4060 76C6.tmp 91 PID 4060 wrote to memory of 2092 4060 76C6.tmp 91 PID 2092 wrote to memory of 3092 2092 7753.tmp 93 PID 2092 wrote to memory of 3092 2092 7753.tmp 93 PID 2092 wrote to memory of 3092 2092 7753.tmp 93 PID 3092 wrote to memory of 2632 3092 77DF.tmp 94 PID 3092 wrote to memory of 2632 3092 77DF.tmp 94 PID 3092 wrote to memory of 2632 3092 77DF.tmp 94 PID 2632 wrote to memory of 4984 2632 784D.tmp 95 PID 2632 wrote to memory of 4984 2632 784D.tmp 95 PID 2632 wrote to memory of 4984 2632 784D.tmp 95 PID 4984 wrote to memory of 3140 4984 7908.tmp 96 PID 4984 wrote to memory of 3140 4984 7908.tmp 96 PID 4984 wrote to memory of 3140 4984 7908.tmp 96 PID 3140 wrote to memory of 4460 3140 79C4.tmp 97 PID 3140 wrote to memory of 4460 3140 79C4.tmp 97 PID 3140 wrote to memory of 4460 3140 79C4.tmp 97 PID 4460 wrote to memory of 3396 4460 7A50.tmp 98 PID 4460 wrote to memory of 3396 4460 7A50.tmp 98 PID 4460 wrote to memory of 3396 4460 7A50.tmp 98 PID 3396 wrote to memory of 3264 3396 7ACD.tmp 99 PID 3396 wrote to memory of 3264 3396 7ACD.tmp 99 PID 3396 wrote to memory of 3264 3396 7ACD.tmp 99 PID 3264 wrote to memory of 4792 3264 7BF6.tmp 100 PID 3264 wrote to memory of 4792 3264 7BF6.tmp 100 PID 3264 wrote to memory of 4792 3264 7BF6.tmp 100 PID 4792 wrote to memory of 3216 4792 7C54.tmp 101 PID 4792 wrote to memory of 3216 4792 7C54.tmp 101 PID 4792 wrote to memory of 3216 4792 7C54.tmp 101 PID 3216 wrote to memory of 468 3216 7CD1.tmp 102 PID 3216 wrote to memory of 468 3216 7CD1.tmp 102 PID 3216 wrote to memory of 468 3216 7CD1.tmp 102 PID 468 wrote to memory of 1636 468 7D3E.tmp 103 PID 468 wrote to memory of 1636 468 7D3E.tmp 103 PID 468 wrote to memory of 1636 468 7D3E.tmp 103 PID 1636 wrote to memory of 3716 1636 7D9C.tmp 104 PID 1636 wrote to memory of 3716 1636 7D9C.tmp 104 PID 1636 wrote to memory of 3716 1636 7D9C.tmp 104 PID 3716 wrote to memory of 3392 3716 7E29.tmp 105 PID 3716 wrote to memory of 3392 3716 7E29.tmp 105 PID 3716 wrote to memory of 3392 3716 7E29.tmp 105 PID 3392 wrote to memory of 4988 3392 7E96.tmp 106 PID 3392 wrote to memory of 4988 3392 7E96.tmp 106 PID 3392 wrote to memory of 4988 3392 7E96.tmp 106 PID 4988 wrote to memory of 3684 4988 7EE4.tmp 107 PID 4988 wrote to memory of 3684 4988 7EE4.tmp 107 PID 4988 wrote to memory of 3684 4988 7EE4.tmp 107 PID 3684 wrote to memory of 2848 3684 7F80.tmp 108 PID 3684 wrote to memory of 2848 3684 7F80.tmp 108 PID 3684 wrote to memory of 2848 3684 7F80.tmp 108 PID 2848 wrote to memory of 3712 2848 7FFD.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-24_7f754a3d982fe24d5e2156941539e82d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\762A.tmp"C:\Users\Admin\AppData\Local\Temp\762A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\76C6.tmp"C:\Users\Admin\AppData\Local\Temp\76C6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\77DF.tmp"C:\Users\Admin\AppData\Local\Temp\77DF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\7A50.tmp"C:\Users\Admin\AppData\Local\Temp\7A50.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"C:\Users\Admin\AppData\Local\Temp\7BF6.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"C:\Users\Admin\AppData\Local\Temp\7CD1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\7E29.tmp"C:\Users\Admin\AppData\Local\Temp\7E29.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"23⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"24⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"25⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"26⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\828E.tmp"C:\Users\Admin\AppData\Local\Temp\828E.tmp"27⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"28⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"29⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"30⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"31⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"32⤵
- Executes dropped EXE
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\85BA.tmp"C:\Users\Admin\AppData\Local\Temp\85BA.tmp"33⤵
- Executes dropped EXE
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\86A5.tmp"C:\Users\Admin\AppData\Local\Temp\86A5.tmp"34⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\86F3.tmp"C:\Users\Admin\AppData\Local\Temp\86F3.tmp"35⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"36⤵
- Executes dropped EXE
PID:4400 -
C:\Users\Admin\AppData\Local\Temp\87AE.tmp"C:\Users\Admin\AppData\Local\Temp\87AE.tmp"37⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"38⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"39⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"40⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\8925.tmp"C:\Users\Admin\AppData\Local\Temp\8925.tmp"41⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\8983.tmp"C:\Users\Admin\AppData\Local\Temp\8983.tmp"42⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\89F0.tmp"C:\Users\Admin\AppData\Local\Temp\89F0.tmp"43⤵
- Executes dropped EXE
PID:888 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"44⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"C:\Users\Admin\AppData\Local\Temp\8ABB.tmp"45⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"46⤵
- Executes dropped EXE
PID:904 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"47⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"48⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\8C23.tmp"C:\Users\Admin\AppData\Local\Temp\8C23.tmp"49⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\8C81.tmp"C:\Users\Admin\AppData\Local\Temp\8C81.tmp"50⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"C:\Users\Admin\AppData\Local\Temp\8CCF.tmp"51⤵
- Executes dropped EXE
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"C:\Users\Admin\AppData\Local\Temp\8D3C.tmp"52⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"C:\Users\Admin\AppData\Local\Temp\8D9A.tmp"53⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8E07.tmp"C:\Users\Admin\AppData\Local\Temp\8E07.tmp"54⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"55⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"C:\Users\Admin\AppData\Local\Temp\8ED2.tmp"56⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\8F30.tmp"C:\Users\Admin\AppData\Local\Temp\8F30.tmp"57⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"C:\Users\Admin\AppData\Local\Temp\8F8E.tmp"58⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"C:\Users\Admin\AppData\Local\Temp\8FEC.tmp"59⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"60⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\90A7.tmp"C:\Users\Admin\AppData\Local\Temp\90A7.tmp"61⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\9114.tmp"C:\Users\Admin\AppData\Local\Temp\9114.tmp"62⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"63⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\91E0.tmp"C:\Users\Admin\AppData\Local\Temp\91E0.tmp"64⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\924D.tmp"C:\Users\Admin\AppData\Local\Temp\924D.tmp"65⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"66⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"67⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"68⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\93F3.tmp"C:\Users\Admin\AppData\Local\Temp\93F3.tmp"69⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\9460.tmp"C:\Users\Admin\AppData\Local\Temp\9460.tmp"70⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"71⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\952B.tmp"C:\Users\Admin\AppData\Local\Temp\952B.tmp"72⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\9599.tmp"C:\Users\Admin\AppData\Local\Temp\9599.tmp"73⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"74⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"75⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"76⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\973F.tmp"C:\Users\Admin\AppData\Local\Temp\973F.tmp"77⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"78⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"79⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"80⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\98E4.tmp"C:\Users\Admin\AppData\Local\Temp\98E4.tmp"81⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"82⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"83⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"C:\Users\Admin\AppData\Local\Temp\9A1D.tmp"84⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"C:\Users\Admin\AppData\Local\Temp\9A8A.tmp"85⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"C:\Users\Admin\AppData\Local\Temp\9AF8.tmp"86⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\9B65.tmp"C:\Users\Admin\AppData\Local\Temp\9B65.tmp"87⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"C:\Users\Admin\AppData\Local\Temp\9BC3.tmp"88⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"89⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"C:\Users\Admin\AppData\Local\Temp\9C7E.tmp"90⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"91⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"92⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"93⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"94⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"95⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\9E82.tmp"C:\Users\Admin\AppData\Local\Temp\9E82.tmp"96⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"97⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"98⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"99⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\A018.tmp"C:\Users\Admin\AppData\Local\Temp\A018.tmp"100⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"101⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"102⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"103⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"104⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"105⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"106⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\A289.tmp"C:\Users\Admin\AppData\Local\Temp\A289.tmp"107⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"C:\Users\Admin\AppData\Local\Temp\A2E7.tmp"108⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\A354.tmp"C:\Users\Admin\AppData\Local\Temp\A354.tmp"109⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"110⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"111⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\A47D.tmp"C:\Users\Admin\AppData\Local\Temp\A47D.tmp"112⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"113⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\A539.tmp"C:\Users\Admin\AppData\Local\Temp\A539.tmp"114⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\A596.tmp"C:\Users\Admin\AppData\Local\Temp\A596.tmp"115⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"116⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"117⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"118⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"119⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"120⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"121⤵PID:2952
-
C:\Users\Admin\AppData\Local\Temp\A827.tmp"C:\Users\Admin\AppData\Local\Temp\A827.tmp"122⤵PID:3684
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-