Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
02/05/2024, 04:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe
-
Size
486KB
-
MD5
7010f1dd0bfd45c6494268d1bbc000d5
-
SHA1
89b8337bdfa052caba10e025b4937b71702f200d
-
SHA256
302e5af49792be903e3488d40eeac7662a9c9b535625008256a3e9d3e2916857
-
SHA512
b6854fd9a165dc13aa9ef76d31e5b212d2852d1ed5acc77ba7bc00b767a6eed6f1e89a0f62e0b1cd270a530436b497a764ca0c8ac2333c8d8a00aab1211e15a5
-
SSDEEP
6144:Forf3lPvovsgZnqG2C7mOTeiLfD7g2zeld39s4cZTdulp7wktWlFN9c1vx9Mmdsz:UU5rCOTeiDg/ldud7ulBwktqi/yNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2912 3383.tmp 4896 342F.tmp 1140 34BC.tmp 4516 3539.tmp 1548 3597.tmp 4720 3604.tmp 4068 3662.tmp 1040 36DF.tmp 4076 375C.tmp 1120 37AA.tmp 2372 3836.tmp 2220 3894.tmp 1008 38F2.tmp 2836 395F.tmp 3824 39BD.tmp 3152 3A2A.tmp 2320 3A98.tmp 3236 3AF6.tmp 224 3B63.tmp 884 3BFF.tmp 3756 3C6D.tmp 832 3D47.tmp 2664 3DC4.tmp 3596 3E41.tmp 860 3EBE.tmp 3800 3F0C.tmp 2364 3F89.tmp 4940 3FD8.tmp 2028 4055.tmp 3260 40D2.tmp 4660 414F.tmp 4964 41EB.tmp 1000 4249.tmp 3520 42A6.tmp 2684 4304.tmp 8 4352.tmp 1092 43A0.tmp 3448 43EE.tmp 2876 444C.tmp 1040 44AA.tmp 3688 44F8.tmp 1044 4556.tmp 2620 45B4.tmp 2372 4602.tmp 3516 465F.tmp 2220 46BD.tmp 3036 471B.tmp 664 4779.tmp 3168 47D6.tmp 3824 4834.tmp 396 4892.tmp 3232 48F0.tmp 2948 494D.tmp 5060 49AB.tmp 684 4A09.tmp 528 4A67.tmp 1208 4AC4.tmp 3348 4B22.tmp 432 4B80.tmp 4044 4BCE.tmp 3632 4C1C.tmp 3440 4C7A.tmp 4960 4CD8.tmp 1916 4D35.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4136 wrote to memory of 2912 4136 2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe 83 PID 4136 wrote to memory of 2912 4136 2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe 83 PID 4136 wrote to memory of 2912 4136 2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe 83 PID 2912 wrote to memory of 4896 2912 3383.tmp 84 PID 2912 wrote to memory of 4896 2912 3383.tmp 84 PID 2912 wrote to memory of 4896 2912 3383.tmp 84 PID 4896 wrote to memory of 1140 4896 342F.tmp 86 PID 4896 wrote to memory of 1140 4896 342F.tmp 86 PID 4896 wrote to memory of 1140 4896 342F.tmp 86 PID 1140 wrote to memory of 4516 1140 34BC.tmp 87 PID 1140 wrote to memory of 4516 1140 34BC.tmp 87 PID 1140 wrote to memory of 4516 1140 34BC.tmp 87 PID 4516 wrote to memory of 1548 4516 3539.tmp 89 PID 4516 wrote to memory of 1548 4516 3539.tmp 89 PID 4516 wrote to memory of 1548 4516 3539.tmp 89 PID 1548 wrote to memory of 4720 1548 3597.tmp 91 PID 1548 wrote to memory of 4720 1548 3597.tmp 91 PID 1548 wrote to memory of 4720 1548 3597.tmp 91 PID 4720 wrote to memory of 4068 4720 3604.tmp 92 PID 4720 wrote to memory of 4068 4720 3604.tmp 92 PID 4720 wrote to memory of 4068 4720 3604.tmp 92 PID 4068 wrote to memory of 1040 4068 3662.tmp 93 PID 4068 wrote to memory of 1040 4068 3662.tmp 93 PID 4068 wrote to memory of 1040 4068 3662.tmp 93 PID 1040 wrote to memory of 4076 1040 36DF.tmp 94 PID 1040 wrote to memory of 4076 1040 36DF.tmp 94 PID 1040 wrote to memory of 4076 1040 36DF.tmp 94 PID 4076 wrote to memory of 1120 4076 375C.tmp 95 PID 4076 wrote to memory of 1120 4076 375C.tmp 95 PID 4076 wrote to memory of 1120 4076 375C.tmp 95 PID 1120 wrote to memory of 2372 1120 37AA.tmp 96 PID 1120 wrote to memory of 2372 1120 37AA.tmp 96 PID 1120 wrote to memory of 2372 1120 37AA.tmp 96 PID 2372 wrote to memory of 2220 2372 3836.tmp 97 PID 2372 wrote to memory of 2220 2372 3836.tmp 97 PID 2372 wrote to memory of 2220 2372 3836.tmp 97 PID 2220 wrote to memory of 1008 2220 3894.tmp 98 PID 2220 wrote to memory of 1008 2220 3894.tmp 98 PID 2220 wrote to memory of 1008 2220 3894.tmp 98 PID 1008 wrote to memory of 2836 1008 38F2.tmp 99 PID 1008 wrote to memory of 2836 1008 38F2.tmp 99 PID 1008 wrote to memory of 2836 1008 38F2.tmp 99 PID 2836 wrote to memory of 3824 2836 395F.tmp 100 PID 2836 wrote to memory of 3824 2836 395F.tmp 100 PID 2836 wrote to memory of 3824 2836 395F.tmp 100 PID 3824 wrote to memory of 3152 3824 39BD.tmp 101 PID 3824 wrote to memory of 3152 3824 39BD.tmp 101 PID 3824 wrote to memory of 3152 3824 39BD.tmp 101 PID 3152 wrote to memory of 2320 3152 3A2A.tmp 103 PID 3152 wrote to memory of 2320 3152 3A2A.tmp 103 PID 3152 wrote to memory of 2320 3152 3A2A.tmp 103 PID 2320 wrote to memory of 3236 2320 3A98.tmp 104 PID 2320 wrote to memory of 3236 2320 3A98.tmp 104 PID 2320 wrote to memory of 3236 2320 3A98.tmp 104 PID 3236 wrote to memory of 224 3236 3AF6.tmp 105 PID 3236 wrote to memory of 224 3236 3AF6.tmp 105 PID 3236 wrote to memory of 224 3236 3AF6.tmp 105 PID 224 wrote to memory of 884 224 3B63.tmp 106 PID 224 wrote to memory of 884 224 3B63.tmp 106 PID 224 wrote to memory of 884 224 3B63.tmp 106 PID 884 wrote to memory of 3756 884 3BFF.tmp 107 PID 884 wrote to memory of 3756 884 3BFF.tmp 107 PID 884 wrote to memory of 3756 884 3BFF.tmp 107 PID 3756 wrote to memory of 832 3756 3C6D.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-02_7010f1dd0bfd45c6494268d1bbc000d5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\342F.tmp"C:\Users\Admin\AppData\Local\Temp\342F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\3662.tmp"C:\Users\Admin\AppData\Local\Temp\3662.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\36DF.tmp"C:\Users\Admin\AppData\Local\Temp\36DF.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\37AA.tmp"C:\Users\Admin\AppData\Local\Temp\37AA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\3894.tmp"C:\Users\Admin\AppData\Local\Temp\3894.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\38F2.tmp"C:\Users\Admin\AppData\Local\Temp\38F2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"C:\Users\Admin\AppData\Local\Temp\3A2A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"C:\Users\Admin\AppData\Local\Temp\3AF6.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"23⤵
- Executes dropped EXE
PID:832 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"24⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"25⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"26⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"27⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"28⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"29⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4055.tmp"C:\Users\Admin\AppData\Local\Temp\4055.tmp"30⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"31⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"32⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"33⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4249.tmp"C:\Users\Admin\AppData\Local\Temp\4249.tmp"34⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"35⤵
- Executes dropped EXE
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"36⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"37⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"38⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"39⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"40⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"41⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"42⤵
- Executes dropped EXE
PID:3688 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"43⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"44⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"45⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"46⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"47⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"48⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"49⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"50⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"51⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"52⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"53⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"54⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"55⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"56⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"57⤵
- Executes dropped EXE
PID:528 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"58⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"59⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"60⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"61⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"62⤵
- Executes dropped EXE
PID:3632 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"63⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"64⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"65⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"66⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"67⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"68⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"69⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"70⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"71⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"72⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"73⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"74⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"75⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"76⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"77⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"78⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"79⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"80⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"81⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"82⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"83⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"84⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"85⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"86⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"87⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"88⤵PID:1088
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"89⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"90⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"91⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"92⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"93⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"94⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"95⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"96⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"97⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"98⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"99⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"100⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"101⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"102⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"103⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"104⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"105⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"106⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"107⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"108⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"109⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"110⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"111⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"112⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"113⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"114⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"115⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"116⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"117⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"118⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"119⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"120⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"121⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"122⤵PID:3260
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-