Analysis
-
max time kernel
150s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
05/07/2024, 13:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe
-
Size
529KB
-
MD5
ef40f98f9a410d302aeab31200dd96e9
-
SHA1
558f97ec16e71f92c19c00ef3a817ff03eab50dd
-
SHA256
8ef304a4bfc01c178b8c4e9ef2606465cadcd54f5aec4ba436f8fb3be0b56ca4
-
SHA512
4809b47020f3e266f19e448ea8cb33194f9ac6bc11afd64ca155eae9ca5ecbff548786f0562fb10b0b851688904a291c439a57ee6f217c94fd5f32c1a1a93806
-
SSDEEP
12288:NU5rCOTeijv+HhXjOyquLjh8sWFNmTZwlH4Hp:NUQOJj6TOuomTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 796 94FC.tmp 4996 9589.tmp 2512 95F6.tmp 668 9683.tmp 2980 9700.tmp 4124 977D.tmp 1964 97FA.tmp 4268 9896.tmp 2476 9933.tmp 2036 9990.tmp 1600 9A2D.tmp 208 9AC9.tmp 692 9B36.tmp 912 9B94.tmp 812 9C11.tmp 2968 9CAD.tmp 4280 9D3A.tmp 2428 9DC6.tmp 2948 9E63.tmp 3860 9EE0.tmp 5048 9F3D.tmp 2272 9FAB.tmp 3144 A009.tmp 372 A0A5.tmp 3160 A18F.tmp 3764 A20C.tmp 2300 A26A.tmp 2868 A2D7.tmp 2748 A335.tmp 1948 A3C2.tmp 2780 A43F.tmp 3296 A4DB.tmp 764 A558.tmp 2500 A5C5.tmp 768 A623.tmp 1084 A681.tmp 1832 A6CF.tmp 2216 A72D.tmp 4252 A78A.tmp 4560 A7E8.tmp 3308 A846.tmp 1088 A8A4.tmp 1564 A901.tmp 3720 A950.tmp 2692 A9BD.tmp 4276 AA2A.tmp 1076 AA88.tmp 1116 AAF5.tmp 2840 AB44.tmp 4480 ABA1.tmp 1644 AC0F.tmp 3768 AC6C.tmp 3740 ACBB.tmp 5060 AD28.tmp 4972 AD95.tmp 376 AE03.tmp 400 AE60.tmp 4036 AEAF.tmp 2064 AEFD.tmp 3240 AF5A.tmp 3504 AFC8.tmp 4684 B026.tmp 3608 B074.tmp 1104 B0D1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5036 wrote to memory of 796 5036 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 84 PID 5036 wrote to memory of 796 5036 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 84 PID 5036 wrote to memory of 796 5036 2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe 84 PID 796 wrote to memory of 4996 796 94FC.tmp 86 PID 796 wrote to memory of 4996 796 94FC.tmp 86 PID 796 wrote to memory of 4996 796 94FC.tmp 86 PID 4996 wrote to memory of 2512 4996 9589.tmp 87 PID 4996 wrote to memory of 2512 4996 9589.tmp 87 PID 4996 wrote to memory of 2512 4996 9589.tmp 87 PID 2512 wrote to memory of 668 2512 95F6.tmp 88 PID 2512 wrote to memory of 668 2512 95F6.tmp 88 PID 2512 wrote to memory of 668 2512 95F6.tmp 88 PID 668 wrote to memory of 2980 668 9683.tmp 89 PID 668 wrote to memory of 2980 668 9683.tmp 89 PID 668 wrote to memory of 2980 668 9683.tmp 89 PID 2980 wrote to memory of 4124 2980 9700.tmp 90 PID 2980 wrote to memory of 4124 2980 9700.tmp 90 PID 2980 wrote to memory of 4124 2980 9700.tmp 90 PID 4124 wrote to memory of 1964 4124 977D.tmp 91 PID 4124 wrote to memory of 1964 4124 977D.tmp 91 PID 4124 wrote to memory of 1964 4124 977D.tmp 91 PID 1964 wrote to memory of 4268 1964 97FA.tmp 92 PID 1964 wrote to memory of 4268 1964 97FA.tmp 92 PID 1964 wrote to memory of 4268 1964 97FA.tmp 92 PID 4268 wrote to memory of 2476 4268 9896.tmp 93 PID 4268 wrote to memory of 2476 4268 9896.tmp 93 PID 4268 wrote to memory of 2476 4268 9896.tmp 93 PID 2476 wrote to memory of 2036 2476 9933.tmp 94 PID 2476 wrote to memory of 2036 2476 9933.tmp 94 PID 2476 wrote to memory of 2036 2476 9933.tmp 94 PID 2036 wrote to memory of 1600 2036 9990.tmp 95 PID 2036 wrote to memory of 1600 2036 9990.tmp 95 PID 2036 wrote to memory of 1600 2036 9990.tmp 95 PID 1600 wrote to memory of 208 1600 9A2D.tmp 96 PID 1600 wrote to memory of 208 1600 9A2D.tmp 96 PID 1600 wrote to memory of 208 1600 9A2D.tmp 96 PID 208 wrote to memory of 692 208 9AC9.tmp 97 PID 208 wrote to memory of 692 208 9AC9.tmp 97 PID 208 wrote to memory of 692 208 9AC9.tmp 97 PID 692 wrote to memory of 912 692 9B36.tmp 98 PID 692 wrote to memory of 912 692 9B36.tmp 98 PID 692 wrote to memory of 912 692 9B36.tmp 98 PID 912 wrote to memory of 812 912 9B94.tmp 99 PID 912 wrote to memory of 812 912 9B94.tmp 99 PID 912 wrote to memory of 812 912 9B94.tmp 99 PID 812 wrote to memory of 2968 812 9C11.tmp 100 PID 812 wrote to memory of 2968 812 9C11.tmp 100 PID 812 wrote to memory of 2968 812 9C11.tmp 100 PID 2968 wrote to memory of 4280 2968 9CAD.tmp 101 PID 2968 wrote to memory of 4280 2968 9CAD.tmp 101 PID 2968 wrote to memory of 4280 2968 9CAD.tmp 101 PID 4280 wrote to memory of 2428 4280 9D3A.tmp 102 PID 4280 wrote to memory of 2428 4280 9D3A.tmp 102 PID 4280 wrote to memory of 2428 4280 9D3A.tmp 102 PID 2428 wrote to memory of 2948 2428 9DC6.tmp 103 PID 2428 wrote to memory of 2948 2428 9DC6.tmp 103 PID 2428 wrote to memory of 2948 2428 9DC6.tmp 103 PID 2948 wrote to memory of 3860 2948 9E63.tmp 104 PID 2948 wrote to memory of 3860 2948 9E63.tmp 104 PID 2948 wrote to memory of 3860 2948 9E63.tmp 104 PID 3860 wrote to memory of 5048 3860 9EE0.tmp 105 PID 3860 wrote to memory of 5048 3860 9EE0.tmp 105 PID 3860 wrote to memory of 5048 3860 9EE0.tmp 105 PID 5048 wrote to memory of 2272 5048 9F3D.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-05_ef40f98f9a410d302aeab31200dd96e9_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\9589.tmp"C:\Users\Admin\AppData\Local\Temp\9589.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\9700.tmp"C:\Users\Admin\AppData\Local\Temp\9700.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\97FA.tmp"C:\Users\Admin\AppData\Local\Temp\97FA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\9990.tmp"C:\Users\Admin\AppData\Local\Temp\9990.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"C:\Users\Admin\AppData\Local\Temp\9A2D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\9B94.tmp"C:\Users\Admin\AppData\Local\Temp\9B94.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"C:\Users\Admin\AppData\Local\Temp\9DC6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\9E63.tmp"C:\Users\Admin\AppData\Local\Temp\9E63.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"C:\Users\Admin\AppData\Local\Temp\9EE0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"23⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"24⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"25⤵
- Executes dropped EXE
PID:372 -
C:\Users\Admin\AppData\Local\Temp\A18F.tmp"C:\Users\Admin\AppData\Local\Temp\A18F.tmp"26⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\A20C.tmp"C:\Users\Admin\AppData\Local\Temp\A20C.tmp"27⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\A26A.tmp"C:\Users\Admin\AppData\Local\Temp\A26A.tmp"28⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"29⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"30⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"C:\Users\Admin\AppData\Local\Temp\A3C2.tmp"31⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"32⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"33⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"34⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"C:\Users\Admin\AppData\Local\Temp\A5C5.tmp"35⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"36⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"37⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"C:\Users\Admin\AppData\Local\Temp\A6CF.tmp"38⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"39⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\A78A.tmp"C:\Users\Admin\AppData\Local\Temp\A78A.tmp"40⤵
- Executes dropped EXE
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"41⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"42⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"43⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"44⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"45⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"C:\Users\Admin\AppData\Local\Temp\A9BD.tmp"46⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"47⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\AA88.tmp"C:\Users\Admin\AppData\Local\Temp\AA88.tmp"48⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"C:\Users\Admin\AppData\Local\Temp\AAF5.tmp"49⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"50⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"51⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"C:\Users\Admin\AppData\Local\Temp\AC0F.tmp"52⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"C:\Users\Admin\AppData\Local\Temp\AC6C.tmp"53⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"C:\Users\Admin\AppData\Local\Temp\ACBB.tmp"54⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"56⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"57⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\AE60.tmp"C:\Users\Admin\AppData\Local\Temp\AE60.tmp"58⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"59⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"C:\Users\Admin\AppData\Local\Temp\AEFD.tmp"60⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"C:\Users\Admin\AppData\Local\Temp\AF5A.tmp"61⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"62⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"63⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\B074.tmp"C:\Users\Admin\AppData\Local\Temp\B074.tmp"64⤵
- Executes dropped EXE
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"C:\Users\Admin\AppData\Local\Temp\B0D1.tmp"65⤵
- Executes dropped EXE
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"66⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"67⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"68⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"69⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\B297.tmp"C:\Users\Admin\AppData\Local\Temp\B297.tmp"70⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"71⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"72⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"73⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"74⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"75⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"C:\Users\Admin\AppData\Local\Temp\B4E8.tmp"76⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\B536.tmp"C:\Users\Admin\AppData\Local\Temp\B536.tmp"77⤵PID:936
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"78⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"79⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"80⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"81⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"82⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"83⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"84⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"85⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"86⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"87⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"88⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"89⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"90⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"91⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"92⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\BB22.tmp"C:\Users\Admin\AppData\Local\Temp\BB22.tmp"93⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"94⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"95⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"96⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"97⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"98⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"99⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"100⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"101⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"C:\Users\Admin\AppData\Local\Temp\BE7D.tmp"102⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\BECC.tmp"C:\Users\Admin\AppData\Local\Temp\BECC.tmp"103⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"104⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"105⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"106⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"107⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"108⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\C10E.tmp"C:\Users\Admin\AppData\Local\Temp\C10E.tmp"109⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\C17B.tmp"C:\Users\Admin\AppData\Local\Temp\C17B.tmp"110⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"C:\Users\Admin\AppData\Local\Temp\C1E8.tmp"111⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"112⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"113⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\C302.tmp"C:\Users\Admin\AppData\Local\Temp\C302.tmp"114⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"115⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"C:\Users\Admin\AppData\Local\Temp\C3DC.tmp"116⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C44A.tmp"C:\Users\Admin\AppData\Local\Temp\C44A.tmp"117⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"118⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\C505.tmp"C:\Users\Admin\AppData\Local\Temp\C505.tmp"119⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\C563.tmp"C:\Users\Admin\AppData\Local\Temp\C563.tmp"120⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"121⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"122⤵PID:3304
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-