Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
24-04-2024 23:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe
-
Size
536KB
-
MD5
010054acb8b6bfc6aceef92b448cff59
-
SHA1
cbaa778906c82308738910bdc256c82d7104d123
-
SHA256
ae486e588c45c326f39cd6d7e2e1a937ee3647ac163cedbb0d172f8d0b44ed43
-
SHA512
006783a9cf3783e1e398d26e8123de5253f475b4e596e0722d6710d0e46e038721427780e2c9499533a2b2ee18a8e007f04fc54e1435720a50d83abf867510ff
-
SSDEEP
12288:wU5rCOTeiU/kkpnirWKHZ1AxTjpcDDt14lPIZxVJ0ZT9:wUQOJU7n8Wa1A5c/4lPIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4396 31AF.tmp 1584 321C.tmp 812 32A9.tmp 4764 3345.tmp 5112 33B2.tmp 1704 3410.tmp 2192 348D.tmp 2312 34FA.tmp 5088 35A6.tmp 1764 3662.tmp 3604 36EE.tmp 1676 375C.tmp 4904 37C9.tmp 1384 3856.tmp 3392 38E2.tmp 4340 398E.tmp 1468 3A0B.tmp 1900 3A98.tmp 448 3B15.tmp 940 3B92.tmp 3708 3C1E.tmp 3680 3C8C.tmp 4736 3D09.tmp 1376 3DA5.tmp 2500 3E12.tmp 3940 3E80.tmp 3724 3F0C.tmp 4344 3F5B.tmp 2492 3FE7.tmp 1020 4093.tmp 1168 4100.tmp 4880 416E.tmp 884 41DB.tmp 3568 4229.tmp 4120 4277.tmp 4980 42C6.tmp 2552 4314.tmp 2764 4362.tmp 2600 43C0.tmp 4204 43FE.tmp 4984 444C.tmp 3888 449A.tmp 4052 44E8.tmp 2336 4546.tmp 2840 45A4.tmp 3304 4611.tmp 3168 465F.tmp 3704 46AE.tmp 3468 46FC.tmp 4924 474A.tmp 3312 4798.tmp 4572 47E6.tmp 1696 4844.tmp 4728 4892.tmp 636 48E0.tmp 3940 492E.tmp 3432 497C.tmp 1444 49CA.tmp 4344 4A09.tmp 2492 4A47.tmp 3384 4A96.tmp 2216 4AE4.tmp 2504 4B32.tmp 4556 4B70.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4748 wrote to memory of 4396 4748 2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe 85 PID 4748 wrote to memory of 4396 4748 2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe 85 PID 4748 wrote to memory of 4396 4748 2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe 85 PID 4396 wrote to memory of 1584 4396 31AF.tmp 86 PID 4396 wrote to memory of 1584 4396 31AF.tmp 86 PID 4396 wrote to memory of 1584 4396 31AF.tmp 86 PID 1584 wrote to memory of 812 1584 321C.tmp 89 PID 1584 wrote to memory of 812 1584 321C.tmp 89 PID 1584 wrote to memory of 812 1584 321C.tmp 89 PID 812 wrote to memory of 4764 812 32A9.tmp 90 PID 812 wrote to memory of 4764 812 32A9.tmp 90 PID 812 wrote to memory of 4764 812 32A9.tmp 90 PID 4764 wrote to memory of 5112 4764 3345.tmp 92 PID 4764 wrote to memory of 5112 4764 3345.tmp 92 PID 4764 wrote to memory of 5112 4764 3345.tmp 92 PID 5112 wrote to memory of 1704 5112 33B2.tmp 93 PID 5112 wrote to memory of 1704 5112 33B2.tmp 93 PID 5112 wrote to memory of 1704 5112 33B2.tmp 93 PID 1704 wrote to memory of 2192 1704 3410.tmp 94 PID 1704 wrote to memory of 2192 1704 3410.tmp 94 PID 1704 wrote to memory of 2192 1704 3410.tmp 94 PID 2192 wrote to memory of 2312 2192 348D.tmp 95 PID 2192 wrote to memory of 2312 2192 348D.tmp 95 PID 2192 wrote to memory of 2312 2192 348D.tmp 95 PID 2312 wrote to memory of 5088 2312 34FA.tmp 97 PID 2312 wrote to memory of 5088 2312 34FA.tmp 97 PID 2312 wrote to memory of 5088 2312 34FA.tmp 97 PID 5088 wrote to memory of 1764 5088 35A6.tmp 98 PID 5088 wrote to memory of 1764 5088 35A6.tmp 98 PID 5088 wrote to memory of 1764 5088 35A6.tmp 98 PID 1764 wrote to memory of 3604 1764 3662.tmp 99 PID 1764 wrote to memory of 3604 1764 3662.tmp 99 PID 1764 wrote to memory of 3604 1764 3662.tmp 99 PID 3604 wrote to memory of 1676 3604 36EE.tmp 100 PID 3604 wrote to memory of 1676 3604 36EE.tmp 100 PID 3604 wrote to memory of 1676 3604 36EE.tmp 100 PID 1676 wrote to memory of 4904 1676 375C.tmp 101 PID 1676 wrote to memory of 4904 1676 375C.tmp 101 PID 1676 wrote to memory of 4904 1676 375C.tmp 101 PID 4904 wrote to memory of 1384 4904 37C9.tmp 102 PID 4904 wrote to memory of 1384 4904 37C9.tmp 102 PID 4904 wrote to memory of 1384 4904 37C9.tmp 102 PID 1384 wrote to memory of 3392 1384 3856.tmp 103 PID 1384 wrote to memory of 3392 1384 3856.tmp 103 PID 1384 wrote to memory of 3392 1384 3856.tmp 103 PID 3392 wrote to memory of 4340 3392 38E2.tmp 104 PID 3392 wrote to memory of 4340 3392 38E2.tmp 104 PID 3392 wrote to memory of 4340 3392 38E2.tmp 104 PID 4340 wrote to memory of 1468 4340 398E.tmp 105 PID 4340 wrote to memory of 1468 4340 398E.tmp 105 PID 4340 wrote to memory of 1468 4340 398E.tmp 105 PID 1468 wrote to memory of 1900 1468 3A0B.tmp 106 PID 1468 wrote to memory of 1900 1468 3A0B.tmp 106 PID 1468 wrote to memory of 1900 1468 3A0B.tmp 106 PID 1900 wrote to memory of 448 1900 3A98.tmp 107 PID 1900 wrote to memory of 448 1900 3A98.tmp 107 PID 1900 wrote to memory of 448 1900 3A98.tmp 107 PID 448 wrote to memory of 940 448 3B15.tmp 108 PID 448 wrote to memory of 940 448 3B15.tmp 108 PID 448 wrote to memory of 940 448 3B15.tmp 108 PID 940 wrote to memory of 3708 940 3B92.tmp 109 PID 940 wrote to memory of 3708 940 3B92.tmp 109 PID 940 wrote to memory of 3708 940 3B92.tmp 109 PID 3708 wrote to memory of 3680 3708 3C1E.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_010054acb8b6bfc6aceef92b448cff59_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\31AF.tmp"C:\Users\Admin\AppData\Local\Temp\31AF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3345.tmp"C:\Users\Admin\AppData\Local\Temp\3345.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\3410.tmp"C:\Users\Admin\AppData\Local\Temp\3410.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\34FA.tmp"C:\Users\Admin\AppData\Local\Temp\34FA.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"C:\Users\Admin\AppData\Local\Temp\3C1E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"23⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"24⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"25⤵
- Executes dropped EXE
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\3E12.tmp"C:\Users\Admin\AppData\Local\Temp\3E12.tmp"26⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"27⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"28⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"29⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"30⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"31⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"32⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"33⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"34⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"35⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"36⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"37⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"38⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"39⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"40⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"41⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"42⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"43⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"44⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"45⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"46⤵
- Executes dropped EXE
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"47⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"48⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"49⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"50⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"51⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"52⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"53⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"54⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"55⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"56⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"57⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"58⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"59⤵
- Executes dropped EXE
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"60⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"61⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"62⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"C:\Users\Admin\AppData\Local\Temp\4AE4.tmp"63⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"64⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"65⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"66⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"67⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"68⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"69⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"70⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"71⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"72⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"73⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"74⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"75⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"76⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"77⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"78⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"79⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"80⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"81⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"82⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"83⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"84⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"85⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"86⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"87⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"88⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"89⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"90⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"91⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"92⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"93⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"94⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"95⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"96⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"97⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"98⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"99⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"100⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"101⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"102⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"103⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"104⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"105⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"106⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"107⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"108⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"109⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"110⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"111⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"112⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"113⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"114⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"115⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"116⤵PID:3996
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"117⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"118⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"119⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"120⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"121⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"122⤵PID:636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-