Analysis
-
max time kernel
150s -
max time network
50s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
30/04/2024, 17:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe
-
Size
536KB
-
MD5
f58fbf5da8f8b9ef37fccfcf2508054e
-
SHA1
19a5aa0c20c3c1c16375c8fc8cebd547b4ea1b8d
-
SHA256
9f869ffe348c3aa9a4d54880f1a43bb184eca091cde4228352d9b59e01fd6d6c
-
SHA512
e95107c33cf0e25f7ae702b1c6d3b493c00ea179da24eeff3fba8cdaa95d0c883075d3c544b0af036c94c6926424ba16d7ca1cdceeb883f0e7ebdcde5a029142
-
SSDEEP
12288:wU5rCOTeiUCylDGafpRtPC8PAXrYa0IZxVJ0ZT9:wUQOJUxAa1PAXQIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 264 44F8.tmp 1228 45D3.tmp 1472 4650.tmp 5064 46FC.tmp 932 47C7.tmp 2976 4882.tmp 2936 490F.tmp 4716 49AB.tmp 3604 4A57.tmp 3156 4B03.tmp 4812 4B80.tmp 2512 4C0D.tmp 4192 4C99.tmp 2420 4D26.tmp 3040 4DC2.tmp 948 4E4F.tmp 4276 4ECC.tmp 4308 4F58.tmp 3572 5004.tmp 4568 50A0.tmp 3220 510E.tmp 3928 519A.tmp 1652 5256.tmp 508 52F2.tmp 4836 537F.tmp 1876 543A.tmp 3484 54E6.tmp 2516 5573.tmp 4304 55FF.tmp 4264 566D.tmp 1536 56EA.tmp 548 5776.tmp 4960 57E4.tmp 1828 5861.tmp 4472 58BF.tmp 2892 591C.tmp 4356 5999.tmp 1120 59E7.tmp 1432 5A45.tmp 4320 5A93.tmp 1176 5B10.tmp 3388 5B7E.tmp 2228 5BEB.tmp 1592 5C49.tmp 3776 5CC6.tmp 5064 5D43.tmp 2392 5D91.tmp 4876 5DDF.tmp 2940 5E2D.tmp 2520 5E8B.tmp 2296 5ED9.tmp 4224 5F27.tmp 1928 5F75.tmp 2340 5FC3.tmp 3236 6021.tmp 4600 606F.tmp 3364 60CD.tmp 4192 612B.tmp 3908 6179.tmp 1380 61C7.tmp 4692 6225.tmp 1760 6273.tmp 4276 62D1.tmp 3264 632E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1200 wrote to memory of 264 1200 2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe 84 PID 1200 wrote to memory of 264 1200 2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe 84 PID 1200 wrote to memory of 264 1200 2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe 84 PID 264 wrote to memory of 1228 264 44F8.tmp 86 PID 264 wrote to memory of 1228 264 44F8.tmp 86 PID 264 wrote to memory of 1228 264 44F8.tmp 86 PID 1228 wrote to memory of 1472 1228 45D3.tmp 88 PID 1228 wrote to memory of 1472 1228 45D3.tmp 88 PID 1228 wrote to memory of 1472 1228 45D3.tmp 88 PID 1472 wrote to memory of 5064 1472 4650.tmp 89 PID 1472 wrote to memory of 5064 1472 4650.tmp 89 PID 1472 wrote to memory of 5064 1472 4650.tmp 89 PID 5064 wrote to memory of 932 5064 46FC.tmp 91 PID 5064 wrote to memory of 932 5064 46FC.tmp 91 PID 5064 wrote to memory of 932 5064 46FC.tmp 91 PID 932 wrote to memory of 2976 932 47C7.tmp 92 PID 932 wrote to memory of 2976 932 47C7.tmp 92 PID 932 wrote to memory of 2976 932 47C7.tmp 92 PID 2976 wrote to memory of 2936 2976 4882.tmp 93 PID 2976 wrote to memory of 2936 2976 4882.tmp 93 PID 2976 wrote to memory of 2936 2976 4882.tmp 93 PID 2936 wrote to memory of 4716 2936 490F.tmp 94 PID 2936 wrote to memory of 4716 2936 490F.tmp 94 PID 2936 wrote to memory of 4716 2936 490F.tmp 94 PID 4716 wrote to memory of 3604 4716 49AB.tmp 95 PID 4716 wrote to memory of 3604 4716 49AB.tmp 95 PID 4716 wrote to memory of 3604 4716 49AB.tmp 95 PID 3604 wrote to memory of 3156 3604 4A57.tmp 96 PID 3604 wrote to memory of 3156 3604 4A57.tmp 96 PID 3604 wrote to memory of 3156 3604 4A57.tmp 96 PID 3156 wrote to memory of 4812 3156 4B03.tmp 97 PID 3156 wrote to memory of 4812 3156 4B03.tmp 97 PID 3156 wrote to memory of 4812 3156 4B03.tmp 97 PID 4812 wrote to memory of 2512 4812 4B80.tmp 98 PID 4812 wrote to memory of 2512 4812 4B80.tmp 98 PID 4812 wrote to memory of 2512 4812 4B80.tmp 98 PID 2512 wrote to memory of 4192 2512 4C0D.tmp 99 PID 2512 wrote to memory of 4192 2512 4C0D.tmp 99 PID 2512 wrote to memory of 4192 2512 4C0D.tmp 99 PID 4192 wrote to memory of 2420 4192 4C99.tmp 100 PID 4192 wrote to memory of 2420 4192 4C99.tmp 100 PID 4192 wrote to memory of 2420 4192 4C99.tmp 100 PID 2420 wrote to memory of 3040 2420 4D26.tmp 101 PID 2420 wrote to memory of 3040 2420 4D26.tmp 101 PID 2420 wrote to memory of 3040 2420 4D26.tmp 101 PID 3040 wrote to memory of 948 3040 4DC2.tmp 102 PID 3040 wrote to memory of 948 3040 4DC2.tmp 102 PID 3040 wrote to memory of 948 3040 4DC2.tmp 102 PID 948 wrote to memory of 4276 948 4E4F.tmp 103 PID 948 wrote to memory of 4276 948 4E4F.tmp 103 PID 948 wrote to memory of 4276 948 4E4F.tmp 103 PID 4276 wrote to memory of 4308 4276 4ECC.tmp 104 PID 4276 wrote to memory of 4308 4276 4ECC.tmp 104 PID 4276 wrote to memory of 4308 4276 4ECC.tmp 104 PID 4308 wrote to memory of 3572 4308 4F58.tmp 105 PID 4308 wrote to memory of 3572 4308 4F58.tmp 105 PID 4308 wrote to memory of 3572 4308 4F58.tmp 105 PID 3572 wrote to memory of 4568 3572 5004.tmp 106 PID 3572 wrote to memory of 4568 3572 5004.tmp 106 PID 3572 wrote to memory of 4568 3572 5004.tmp 106 PID 4568 wrote to memory of 3220 4568 50A0.tmp 107 PID 4568 wrote to memory of 3220 4568 50A0.tmp 107 PID 4568 wrote to memory of 3220 4568 50A0.tmp 107 PID 3220 wrote to memory of 3928 3220 510E.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-30_f58fbf5da8f8b9ef37fccfcf2508054e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:264 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:932 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"23⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"24⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"25⤵
- Executes dropped EXE
PID:508 -
C:\Users\Admin\AppData\Local\Temp\537F.tmp"C:\Users\Admin\AppData\Local\Temp\537F.tmp"26⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"27⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"28⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"29⤵
- Executes dropped EXE
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"30⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"31⤵
- Executes dropped EXE
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"32⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"33⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"34⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"35⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"36⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"37⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"38⤵
- Executes dropped EXE
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"39⤵
- Executes dropped EXE
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"40⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"41⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"42⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"43⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"44⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"45⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"46⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"47⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"48⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"49⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"50⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"51⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"52⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"53⤵
- Executes dropped EXE
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"54⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"55⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"56⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"57⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"58⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"59⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"60⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"61⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"62⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"63⤵
- Executes dropped EXE
PID:1760 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"64⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"65⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"66⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"67⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"68⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"69⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"70⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"71⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"72⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"73⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"74⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"75⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"76⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"77⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"78⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"79⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"80⤵PID:3636
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"81⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"82⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"83⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"84⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"85⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"86⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"87⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"88⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"89⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"90⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"91⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"92⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"93⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\6C66.tmp"C:\Users\Admin\AppData\Local\Temp\6C66.tmp"94⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"95⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"96⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"97⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"98⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"99⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"100⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"101⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"102⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"103⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"104⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"105⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"106⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"107⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"108⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"109⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"110⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"111⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"112⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"113⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"114⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"115⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"116⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"117⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"118⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"119⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"120⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\74F1.tmp"C:\Users\Admin\AppData\Local\Temp\74F1.tmp"121⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"122⤵PID:3180
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-