Analysis
-
max time kernel
150s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 07:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe
-
Size
527KB
-
MD5
35b2dddab65224b7371554f8331ef972
-
SHA1
9bf2e37f936a45a9480b60c5fddb917dd3d3c736
-
SHA256
4cad16923d0ba95806d16b11ab8072b2a9cb72ae433696c57c0040847a2afa27
-
SHA512
8cb0769da55d538d6b9b55bee64373e3eb01574ed05471a38dfa1cfbcff89f44cc63658523ea4e2c75af161240c79d5b68c7e0afc0ddc85e6f1b9a9ad7ac8dcf
-
SSDEEP
12288:fU5rCOTeid3est1gPxMkkoI6crvvWYDZu:fUQOJd3est06oIPGYDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4828 53DD.tmp 3816 5479.tmp 460 54F6.tmp 4396 55A2.tmp 4352 560F.tmp 4212 56BB.tmp 1748 5748.tmp 3740 57B5.tmp 944 5832.tmp 4616 58AF.tmp 3456 591C.tmp 1228 59C8.tmp 1828 5A55.tmp 3664 5AD2.tmp 2208 5B4F.tmp 748 5BCC.tmp 3976 5C39.tmp 4556 5CB6.tmp 5032 5D14.tmp 3236 5D72.tmp 5028 5DEF.tmp 4476 5E8B.tmp 1176 5F56.tmp 2592 5FF2.tmp 3084 6060.tmp 1604 60CD.tmp 2148 615A.tmp 2824 61B7.tmp 3568 6234.tmp 2688 62D1.tmp 2456 632E.tmp 5044 639C.tmp 4760 6438.tmp 4696 6486.tmp 1984 64F4.tmp 4560 6561.tmp 2328 65CE.tmp 2644 662C.tmp 2164 6699.tmp 396 66F7.tmp 2740 6755.tmp 3680 67B3.tmp 3524 6810.tmp 1224 685F.tmp 3452 68AD.tmp 3956 690A.tmp 3988 6968.tmp 4544 69C6.tmp 2040 6A24.tmp 1400 6A81.tmp 3520 6AD0.tmp 4484 6B1E.tmp 4648 6B7B.tmp 2136 6BD9.tmp 2132 6C27.tmp 4220 6CC4.tmp 4464 6D21.tmp 848 6D7F.tmp 2856 6DCD.tmp 4936 6E3B.tmp 2792 6EA8.tmp 4992 6F15.tmp 4244 6F73.tmp 2460 6FE0.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2684 wrote to memory of 4828 2684 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 80 PID 2684 wrote to memory of 4828 2684 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 80 PID 2684 wrote to memory of 4828 2684 2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe 80 PID 4828 wrote to memory of 3816 4828 53DD.tmp 81 PID 4828 wrote to memory of 3816 4828 53DD.tmp 81 PID 4828 wrote to memory of 3816 4828 53DD.tmp 81 PID 3816 wrote to memory of 460 3816 5479.tmp 82 PID 3816 wrote to memory of 460 3816 5479.tmp 82 PID 3816 wrote to memory of 460 3816 5479.tmp 82 PID 460 wrote to memory of 4396 460 54F6.tmp 83 PID 460 wrote to memory of 4396 460 54F6.tmp 83 PID 460 wrote to memory of 4396 460 54F6.tmp 83 PID 4396 wrote to memory of 4352 4396 55A2.tmp 84 PID 4396 wrote to memory of 4352 4396 55A2.tmp 84 PID 4396 wrote to memory of 4352 4396 55A2.tmp 84 PID 4352 wrote to memory of 4212 4352 560F.tmp 85 PID 4352 wrote to memory of 4212 4352 560F.tmp 85 PID 4352 wrote to memory of 4212 4352 560F.tmp 85 PID 4212 wrote to memory of 1748 4212 56BB.tmp 86 PID 4212 wrote to memory of 1748 4212 56BB.tmp 86 PID 4212 wrote to memory of 1748 4212 56BB.tmp 86 PID 1748 wrote to memory of 3740 1748 5748.tmp 87 PID 1748 wrote to memory of 3740 1748 5748.tmp 87 PID 1748 wrote to memory of 3740 1748 5748.tmp 87 PID 3740 wrote to memory of 944 3740 57B5.tmp 88 PID 3740 wrote to memory of 944 3740 57B5.tmp 88 PID 3740 wrote to memory of 944 3740 57B5.tmp 88 PID 944 wrote to memory of 4616 944 5832.tmp 89 PID 944 wrote to memory of 4616 944 5832.tmp 89 PID 944 wrote to memory of 4616 944 5832.tmp 89 PID 4616 wrote to memory of 3456 4616 58AF.tmp 90 PID 4616 wrote to memory of 3456 4616 58AF.tmp 90 PID 4616 wrote to memory of 3456 4616 58AF.tmp 90 PID 3456 wrote to memory of 1228 3456 591C.tmp 91 PID 3456 wrote to memory of 1228 3456 591C.tmp 91 PID 3456 wrote to memory of 1228 3456 591C.tmp 91 PID 1228 wrote to memory of 1828 1228 59C8.tmp 92 PID 1228 wrote to memory of 1828 1228 59C8.tmp 92 PID 1228 wrote to memory of 1828 1228 59C8.tmp 92 PID 1828 wrote to memory of 3664 1828 5A55.tmp 93 PID 1828 wrote to memory of 3664 1828 5A55.tmp 93 PID 1828 wrote to memory of 3664 1828 5A55.tmp 93 PID 3664 wrote to memory of 2208 3664 5AD2.tmp 94 PID 3664 wrote to memory of 2208 3664 5AD2.tmp 94 PID 3664 wrote to memory of 2208 3664 5AD2.tmp 94 PID 2208 wrote to memory of 748 2208 5B4F.tmp 95 PID 2208 wrote to memory of 748 2208 5B4F.tmp 95 PID 2208 wrote to memory of 748 2208 5B4F.tmp 95 PID 748 wrote to memory of 3976 748 5BCC.tmp 96 PID 748 wrote to memory of 3976 748 5BCC.tmp 96 PID 748 wrote to memory of 3976 748 5BCC.tmp 96 PID 3976 wrote to memory of 4556 3976 5C39.tmp 97 PID 3976 wrote to memory of 4556 3976 5C39.tmp 97 PID 3976 wrote to memory of 4556 3976 5C39.tmp 97 PID 4556 wrote to memory of 5032 4556 5CB6.tmp 98 PID 4556 wrote to memory of 5032 4556 5CB6.tmp 98 PID 4556 wrote to memory of 5032 4556 5CB6.tmp 98 PID 5032 wrote to memory of 3236 5032 5D14.tmp 99 PID 5032 wrote to memory of 3236 5032 5D14.tmp 99 PID 5032 wrote to memory of 3236 5032 5D14.tmp 99 PID 3236 wrote to memory of 5028 3236 5D72.tmp 102 PID 3236 wrote to memory of 5028 3236 5D72.tmp 102 PID 3236 wrote to memory of 5028 3236 5D72.tmp 102 PID 5028 wrote to memory of 4476 5028 5DEF.tmp 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_35b2dddab65224b7371554f8331ef972_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"23⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"24⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"25⤵
- Executes dropped EXE
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"26⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"27⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"28⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"29⤵
- Executes dropped EXE
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"30⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"31⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"32⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"33⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"34⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"35⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"36⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"37⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"38⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"39⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"40⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"41⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"42⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"43⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"44⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"45⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"46⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"47⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"48⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"49⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"50⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"51⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"52⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"53⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"54⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"55⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"56⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"57⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"58⤵
- Executes dropped EXE
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"59⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"60⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"61⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"62⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"63⤵
- Executes dropped EXE
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"64⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"65⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"66⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"67⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"68⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"69⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"70⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"71⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"72⤵PID:368
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"73⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"74⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"75⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\73D8.tmp"C:\Users\Admin\AppData\Local\Temp\73D8.tmp"76⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\7436.tmp"C:\Users\Admin\AppData\Local\Temp\7436.tmp"77⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"78⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"79⤵PID:444
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"80⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"81⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"82⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"83⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"84⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"85⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"86⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\77EF.tmp"C:\Users\Admin\AppData\Local\Temp\77EF.tmp"87⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"88⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"89⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7918.tmp"C:\Users\Admin\AppData\Local\Temp\7918.tmp"90⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\7985.tmp"C:\Users\Admin\AppData\Local\Temp\7985.tmp"91⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"92⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"93⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"94⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"95⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"96⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"97⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"C:\Users\Admin\AppData\Local\Temp\7BB8.tmp"98⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"99⤵PID:512
-
C:\Users\Admin\AppData\Local\Temp\7C73.tmp"C:\Users\Admin\AppData\Local\Temp\7C73.tmp"100⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"101⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"C:\Users\Admin\AppData\Local\Temp\7D3E.tmp"102⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"C:\Users\Admin\AppData\Local\Temp\7D9C.tmp"103⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"104⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7E38.tmp"C:\Users\Admin\AppData\Local\Temp\7E38.tmp"105⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\7E96.tmp"C:\Users\Admin\AppData\Local\Temp\7E96.tmp"106⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"107⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"108⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"C:\Users\Admin\AppData\Local\Temp\7FAF.tmp"109⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"C:\Users\Admin\AppData\Local\Temp\7FFD.tmp"110⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"111⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"112⤵PID:968
-
C:\Users\Admin\AppData\Local\Temp\8107.tmp"C:\Users\Admin\AppData\Local\Temp\8107.tmp"113⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"114⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"115⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\8211.tmp"C:\Users\Admin\AppData\Local\Temp\8211.tmp"116⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"117⤵PID:1416
-
C:\Users\Admin\AppData\Local\Temp\82CC.tmp"C:\Users\Admin\AppData\Local\Temp\82CC.tmp"118⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\832A.tmp"C:\Users\Admin\AppData\Local\Temp\832A.tmp"119⤵PID:1308
-
C:\Users\Admin\AppData\Local\Temp\8388.tmp"C:\Users\Admin\AppData\Local\Temp\8388.tmp"120⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"121⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\8424.tmp"C:\Users\Admin\AppData\Local\Temp\8424.tmp"122⤵PID:848
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-