Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2024, 12:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe
-
Size
520KB
-
MD5
bd2ee7b800b2ce8be2afba6e9c4f655c
-
SHA1
23b84cd10757fd0ce3139c825e07706260197ae9
-
SHA256
e73b96706db0e12afa73f084a5edbbe84b881ab0dbd759a1d3d1daf4c4e0ef38
-
SHA512
e533d293ed77f45b81adcb83a53d28a187444a9c1e464303f3177b5c2c7bb0292a3d9ffb15c0e59bd28f135a614492262ab8d02c9da6ce30cbd3db2982b5a4f7
-
SSDEEP
12288:gj8fuxR21t5i8fX3ZV26MFtwBdot7hHOMJoe/zNTgH1+XNZ:gj8fuK1GY5VetAdot7QMee794UN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 840 F136.tmp 4916 F25F.tmp 2236 F32A.tmp 1612 F424.tmp 3496 F4FF.tmp 3472 F5AA.tmp 2980 F666.tmp 4724 F712.tmp 3512 F7DD.tmp 4632 F85A.tmp 1012 F925.tmp 4384 F9D1.tmp 2632 FA6D.tmp 4024 FAFA.tmp 4292 FBA6.tmp 2624 FC13.tmp 2300 FCA0.tmp 4864 FD4C.tmp 2552 FDD8.tmp 4592 FE36.tmp 2936 FEE2.tmp 4488 FF8E.tmp 2924 1A.tmp 4532 C6.tmp 4356 134.tmp 4684 1FF.tmp 4144 27C.tmp 2748 2E9.tmp 4808 385.tmp 1588 412.tmp 4820 49F.tmp 3464 589.tmp 1852 644.tmp 5080 710.tmp 4392 7CB.tmp 4712 952.tmp 4192 9DE.tmp 572 AA9.tmp 3368 B94.tmp 1360 C40.tmp 2076 CBD.tmp 4664 D3A.tmp 5076 DA7.tmp 980 E24.tmp 2500 EB1.tmp 4580 F4D.tmp 2920 FBA.tmp 3900 1047.tmp 3080 10F3.tmp 3532 118F.tmp 4512 12B8.tmp 2160 1354.tmp 2196 13D1.tmp 2708 144E.tmp 2340 14DB.tmp 908 1548.tmp 1156 15D5.tmp 2380 1652.tmp 1788 173C.tmp 4288 17C9.tmp 2336 18B3.tmp 4844 194F.tmp 1664 19DC.tmp 2936 1A59.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 840 452 2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe 91 PID 452 wrote to memory of 840 452 2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe 91 PID 452 wrote to memory of 840 452 2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe 91 PID 840 wrote to memory of 4916 840 F136.tmp 92 PID 840 wrote to memory of 4916 840 F136.tmp 92 PID 840 wrote to memory of 4916 840 F136.tmp 92 PID 4916 wrote to memory of 2236 4916 F25F.tmp 93 PID 4916 wrote to memory of 2236 4916 F25F.tmp 93 PID 4916 wrote to memory of 2236 4916 F25F.tmp 93 PID 2236 wrote to memory of 1612 2236 F32A.tmp 94 PID 2236 wrote to memory of 1612 2236 F32A.tmp 94 PID 2236 wrote to memory of 1612 2236 F32A.tmp 94 PID 1612 wrote to memory of 3496 1612 F424.tmp 95 PID 1612 wrote to memory of 3496 1612 F424.tmp 95 PID 1612 wrote to memory of 3496 1612 F424.tmp 95 PID 3496 wrote to memory of 3472 3496 F4FF.tmp 96 PID 3496 wrote to memory of 3472 3496 F4FF.tmp 96 PID 3496 wrote to memory of 3472 3496 F4FF.tmp 96 PID 3472 wrote to memory of 2980 3472 F5AA.tmp 97 PID 3472 wrote to memory of 2980 3472 F5AA.tmp 97 PID 3472 wrote to memory of 2980 3472 F5AA.tmp 97 PID 2980 wrote to memory of 4724 2980 F666.tmp 98 PID 2980 wrote to memory of 4724 2980 F666.tmp 98 PID 2980 wrote to memory of 4724 2980 F666.tmp 98 PID 4724 wrote to memory of 3512 4724 F712.tmp 99 PID 4724 wrote to memory of 3512 4724 F712.tmp 99 PID 4724 wrote to memory of 3512 4724 F712.tmp 99 PID 3512 wrote to memory of 4632 3512 F7DD.tmp 100 PID 3512 wrote to memory of 4632 3512 F7DD.tmp 100 PID 3512 wrote to memory of 4632 3512 F7DD.tmp 100 PID 4632 wrote to memory of 1012 4632 F85A.tmp 101 PID 4632 wrote to memory of 1012 4632 F85A.tmp 101 PID 4632 wrote to memory of 1012 4632 F85A.tmp 101 PID 1012 wrote to memory of 4384 1012 F925.tmp 102 PID 1012 wrote to memory of 4384 1012 F925.tmp 102 PID 1012 wrote to memory of 4384 1012 F925.tmp 102 PID 4384 wrote to memory of 2632 4384 F9D1.tmp 103 PID 4384 wrote to memory of 2632 4384 F9D1.tmp 103 PID 4384 wrote to memory of 2632 4384 F9D1.tmp 103 PID 2632 wrote to memory of 4024 2632 FA6D.tmp 104 PID 2632 wrote to memory of 4024 2632 FA6D.tmp 104 PID 2632 wrote to memory of 4024 2632 FA6D.tmp 104 PID 4024 wrote to memory of 4292 4024 FAFA.tmp 105 PID 4024 wrote to memory of 4292 4024 FAFA.tmp 105 PID 4024 wrote to memory of 4292 4024 FAFA.tmp 105 PID 4292 wrote to memory of 2624 4292 FBA6.tmp 106 PID 4292 wrote to memory of 2624 4292 FBA6.tmp 106 PID 4292 wrote to memory of 2624 4292 FBA6.tmp 106 PID 2624 wrote to memory of 2300 2624 FC13.tmp 107 PID 2624 wrote to memory of 2300 2624 FC13.tmp 107 PID 2624 wrote to memory of 2300 2624 FC13.tmp 107 PID 2300 wrote to memory of 4864 2300 FCA0.tmp 108 PID 2300 wrote to memory of 4864 2300 FCA0.tmp 108 PID 2300 wrote to memory of 4864 2300 FCA0.tmp 108 PID 4864 wrote to memory of 2552 4864 FD4C.tmp 109 PID 4864 wrote to memory of 2552 4864 FD4C.tmp 109 PID 4864 wrote to memory of 2552 4864 FD4C.tmp 109 PID 2552 wrote to memory of 4592 2552 FDD8.tmp 110 PID 2552 wrote to memory of 4592 2552 FDD8.tmp 110 PID 2552 wrote to memory of 4592 2552 FDD8.tmp 110 PID 4592 wrote to memory of 2936 4592 FE36.tmp 111 PID 4592 wrote to memory of 2936 4592 FE36.tmp 111 PID 4592 wrote to memory of 2936 4592 FE36.tmp 111 PID 2936 wrote to memory of 4488 2936 FEE2.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-07_bd2ee7b800b2ce8be2afba6e9c4f655c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\F136.tmp"C:\Users\Admin\AppData\Local\Temp\F136.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\F32A.tmp"C:\Users\Admin\AppData\Local\Temp\F32A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\F424.tmp"C:\Users\Admin\AppData\Local\Temp\F424.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"C:\Users\Admin\AppData\Local\Temp\F4FF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"C:\Users\Admin\AppData\Local\Temp\F5AA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\F666.tmp"C:\Users\Admin\AppData\Local\Temp\F666.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\F712.tmp"C:\Users\Admin\AppData\Local\Temp\F712.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\F85A.tmp"C:\Users\Admin\AppData\Local\Temp\F85A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\F925.tmp"C:\Users\Admin\AppData\Local\Temp\F925.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"C:\Users\Admin\AppData\Local\Temp\F9D1.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"C:\Users\Admin\AppData\Local\Temp\FA6D.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"C:\Users\Admin\AppData\Local\Temp\FBA6.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\FC13.tmp"C:\Users\Admin\AppData\Local\Temp\FC13.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"C:\Users\Admin\AppData\Local\Temp\FCA0.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"C:\Users\Admin\AppData\Local\Temp\FDD8.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\FE36.tmp"C:\Users\Admin\AppData\Local\Temp\FE36.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"C:\Users\Admin\AppData\Local\Temp\FEE2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"C:\Users\Admin\AppData\Local\Temp\FF8E.tmp"23⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\1A.tmp"C:\Users\Admin\AppData\Local\Temp\1A.tmp"24⤵
- Executes dropped EXE
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\C6.tmp"C:\Users\Admin\AppData\Local\Temp\C6.tmp"25⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"26⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\1FF.tmp"C:\Users\Admin\AppData\Local\Temp\1FF.tmp"27⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\27C.tmp"C:\Users\Admin\AppData\Local\Temp\27C.tmp"28⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\2E9.tmp"C:\Users\Admin\AppData\Local\Temp\2E9.tmp"29⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"30⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\412.tmp"C:\Users\Admin\AppData\Local\Temp\412.tmp"31⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\49F.tmp"C:\Users\Admin\AppData\Local\Temp\49F.tmp"32⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\589.tmp"C:\Users\Admin\AppData\Local\Temp\589.tmp"33⤵
- Executes dropped EXE
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"34⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\710.tmp"C:\Users\Admin\AppData\Local\Temp\710.tmp"35⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"36⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"37⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"38⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"39⤵
- Executes dropped EXE
PID:572 -
C:\Users\Admin\AppData\Local\Temp\B94.tmp"C:\Users\Admin\AppData\Local\Temp\B94.tmp"40⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"41⤵
- Executes dropped EXE
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"42⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"43⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\DA7.tmp"C:\Users\Admin\AppData\Local\Temp\DA7.tmp"44⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"45⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"46⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"47⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\FBA.tmp"C:\Users\Admin\AppData\Local\Temp\FBA.tmp"48⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\1047.tmp"C:\Users\Admin\AppData\Local\Temp\1047.tmp"49⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\10F3.tmp"C:\Users\Admin\AppData\Local\Temp\10F3.tmp"50⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\118F.tmp"C:\Users\Admin\AppData\Local\Temp\118F.tmp"51⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\12B8.tmp"C:\Users\Admin\AppData\Local\Temp\12B8.tmp"52⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\1354.tmp"C:\Users\Admin\AppData\Local\Temp\1354.tmp"53⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"54⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"55⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\14DB.tmp"C:\Users\Admin\AppData\Local\Temp\14DB.tmp"56⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\1548.tmp"C:\Users\Admin\AppData\Local\Temp\1548.tmp"57⤵
- Executes dropped EXE
PID:908 -
C:\Users\Admin\AppData\Local\Temp\15D5.tmp"C:\Users\Admin\AppData\Local\Temp\15D5.tmp"58⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\1652.tmp"C:\Users\Admin\AppData\Local\Temp\1652.tmp"59⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\173C.tmp"C:\Users\Admin\AppData\Local\Temp\173C.tmp"60⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\17C9.tmp"C:\Users\Admin\AppData\Local\Temp\17C9.tmp"61⤵
- Executes dropped EXE
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\18B3.tmp"C:\Users\Admin\AppData\Local\Temp\18B3.tmp"62⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\194F.tmp"C:\Users\Admin\AppData\Local\Temp\194F.tmp"63⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"64⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"65⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\1B72.tmp"C:\Users\Admin\AppData\Local\Temp\1B72.tmp"66⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"C:\Users\Admin\AppData\Local\Temp\1BE0.tmp"67⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"68⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"C:\Users\Admin\AppData\Local\Temp\1CCA.tmp"69⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"70⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\1E31.tmp"C:\Users\Admin\AppData\Local\Temp\1E31.tmp"71⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"C:\Users\Admin\AppData\Local\Temp\1ECE.tmp"72⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"C:\Users\Admin\AppData\Local\Temp\1F4B.tmp"73⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"C:\Users\Admin\AppData\Local\Temp\1FE7.tmp"74⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"75⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"76⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\218D.tmp"C:\Users\Admin\AppData\Local\Temp\218D.tmp"77⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\2219.tmp"C:\Users\Admin\AppData\Local\Temp\2219.tmp"78⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\22B6.tmp"C:\Users\Admin\AppData\Local\Temp\22B6.tmp"79⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\2333.tmp"C:\Users\Admin\AppData\Local\Temp\2333.tmp"80⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\23A0.tmp"C:\Users\Admin\AppData\Local\Temp\23A0.tmp"81⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\241D.tmp"C:\Users\Admin\AppData\Local\Temp\241D.tmp"82⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"83⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\2565.tmp"C:\Users\Admin\AppData\Local\Temp\2565.tmp"84⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\25F2.tmp"C:\Users\Admin\AppData\Local\Temp\25F2.tmp"85⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\269E.tmp"C:\Users\Admin\AppData\Local\Temp\269E.tmp"86⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"87⤵PID:3396
-
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"88⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"89⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\28FF.tmp"C:\Users\Admin\AppData\Local\Temp\28FF.tmp"90⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\29AB.tmp"C:\Users\Admin\AppData\Local\Temp\29AB.tmp"91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\2A38.tmp"C:\Users\Admin\AppData\Local\Temp\2A38.tmp"92⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"93⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"C:\Users\Admin\AppData\Local\Temp\2B9F.tmp"94⤵PID:3772
-
C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"C:\Users\Admin\AppData\Local\Temp\2C3B.tmp"95⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"C:\Users\Admin\AppData\Local\Temp\2CD7.tmp"96⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\2D83.tmp"C:\Users\Admin\AppData\Local\Temp\2D83.tmp"97⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"C:\Users\Admin\AppData\Local\Temp\2E3F.tmp"98⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"C:\Users\Admin\AppData\Local\Temp\2EEB.tmp"99⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\2F77.tmp"C:\Users\Admin\AppData\Local\Temp\2F77.tmp"100⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"C:\Users\Admin\AppData\Local\Temp\2FE5.tmp"101⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"102⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\310E.tmp"C:\Users\Admin\AppData\Local\Temp\310E.tmp"103⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"104⤵PID:420
-
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"105⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\32C3.tmp"C:\Users\Admin\AppData\Local\Temp\32C3.tmp"106⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"107⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"108⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\3498.tmp"C:\Users\Admin\AppData\Local\Temp\3498.tmp"109⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\3534.tmp"C:\Users\Admin\AppData\Local\Temp\3534.tmp"110⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\35D0.tmp"C:\Users\Admin\AppData\Local\Temp\35D0.tmp"111⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\366D.tmp"C:\Users\Admin\AppData\Local\Temp\366D.tmp"112⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\36EA.tmp"C:\Users\Admin\AppData\Local\Temp\36EA.tmp"113⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\3776.tmp"C:\Users\Admin\AppData\Local\Temp\3776.tmp"114⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"115⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\389F.tmp"C:\Users\Admin\AppData\Local\Temp\389F.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\391C.tmp"C:\Users\Admin\AppData\Local\Temp\391C.tmp"117⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\39A9.tmp"C:\Users\Admin\AppData\Local\Temp\39A9.tmp"118⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"119⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"C:\Users\Admin\AppData\Local\Temp\3AC2.tmp"120⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"C:\Users\Admin\AppData\Local\Temp\3B3F.tmp"121⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"C:\Users\Admin\AppData\Local\Temp\3BFA.tmp"122⤵PID:980
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-