Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
07/05/2024, 01:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe
-
Size
487KB
-
MD5
7fd728333125eaa5e0effedc936afb67
-
SHA1
13d0a0db9d463447d6e0aa2ac3826922d8e66f8e
-
SHA256
1fe8a8333f6bb39f3dbcadf9999d8fc2c416806f3fb031e701b57586e2bf206b
-
SHA512
03e31a0dbf4a0cb2e75c5c50db9254fb85f01948927d146cd166936057d57deebb66605301993630a073378b0bdf29625a9da2547ade437684f190a0c7bdde0c
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUCHDYVFEar/nnRPtVpKzu6soDT/SKgE9Upq7c:HU5rCOTeiJ3RabnnRnpKzu6sw6EUxNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3976 40D2.tmp 4444 413F.tmp 4772 41CC.tmp 1012 4239.tmp 2484 42B6.tmp 5036 4323.tmp 1752 4391.tmp 208 43FE.tmp 1564 445C.tmp 1236 44C9.tmp 4544 4527.tmp 2800 4575.tmp 4440 45E2.tmp 540 4640.tmp 4536 469E.tmp 4604 471B.tmp 2992 4769.tmp 3440 47C7.tmp 4740 4825.tmp 336 4882.tmp 3704 48F0.tmp 4876 494D.tmp 4872 49AB.tmp 4428 4A38.tmp 4352 4AB5.tmp 3216 4B13.tmp 4236 4B70.tmp 2808 4BCE.tmp 2584 4C2C.tmp 4984 4C99.tmp 1688 4D07.tmp 4052 4D64.tmp 2000 4DB2.tmp 4760 4E01.tmp 4444 4E4F.tmp 4568 4E9D.tmp 2368 4EEB.tmp 4860 4F58.tmp 2560 4FA6.tmp 5036 4FF5.tmp 3168 5052.tmp 2716 50C0.tmp 208 511D.tmp 1564 517B.tmp 4456 51D9.tmp 3492 5237.tmp 4280 5285.tmp 4520 52D3.tmp 2264 5321.tmp 1640 536F.tmp 4668 53BD.tmp 3916 540B.tmp 4976 5469.tmp 1624 54B7.tmp 4272 5515.tmp 952 5573.tmp 4868 55D1.tmp 1932 561F.tmp 4204 567C.tmp 336 56DA.tmp 1696 5738.tmp 3428 57A5.tmp 5064 5803.tmp 4064 5851.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3976 3788 2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe 84 PID 3788 wrote to memory of 3976 3788 2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe 84 PID 3788 wrote to memory of 3976 3788 2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe 84 PID 3976 wrote to memory of 4444 3976 40D2.tmp 85 PID 3976 wrote to memory of 4444 3976 40D2.tmp 85 PID 3976 wrote to memory of 4444 3976 40D2.tmp 85 PID 4444 wrote to memory of 4772 4444 413F.tmp 87 PID 4444 wrote to memory of 4772 4444 413F.tmp 87 PID 4444 wrote to memory of 4772 4444 413F.tmp 87 PID 4772 wrote to memory of 1012 4772 41CC.tmp 89 PID 4772 wrote to memory of 1012 4772 41CC.tmp 89 PID 4772 wrote to memory of 1012 4772 41CC.tmp 89 PID 1012 wrote to memory of 2484 1012 4239.tmp 90 PID 1012 wrote to memory of 2484 1012 4239.tmp 90 PID 1012 wrote to memory of 2484 1012 4239.tmp 90 PID 2484 wrote to memory of 5036 2484 42B6.tmp 92 PID 2484 wrote to memory of 5036 2484 42B6.tmp 92 PID 2484 wrote to memory of 5036 2484 42B6.tmp 92 PID 5036 wrote to memory of 1752 5036 4323.tmp 93 PID 5036 wrote to memory of 1752 5036 4323.tmp 93 PID 5036 wrote to memory of 1752 5036 4323.tmp 93 PID 1752 wrote to memory of 208 1752 4391.tmp 94 PID 1752 wrote to memory of 208 1752 4391.tmp 94 PID 1752 wrote to memory of 208 1752 4391.tmp 94 PID 208 wrote to memory of 1564 208 43FE.tmp 95 PID 208 wrote to memory of 1564 208 43FE.tmp 95 PID 208 wrote to memory of 1564 208 43FE.tmp 95 PID 1564 wrote to memory of 1236 1564 445C.tmp 96 PID 1564 wrote to memory of 1236 1564 445C.tmp 96 PID 1564 wrote to memory of 1236 1564 445C.tmp 96 PID 1236 wrote to memory of 4544 1236 44C9.tmp 97 PID 1236 wrote to memory of 4544 1236 44C9.tmp 97 PID 1236 wrote to memory of 4544 1236 44C9.tmp 97 PID 4544 wrote to memory of 2800 4544 4527.tmp 98 PID 4544 wrote to memory of 2800 4544 4527.tmp 98 PID 4544 wrote to memory of 2800 4544 4527.tmp 98 PID 2800 wrote to memory of 4440 2800 4575.tmp 99 PID 2800 wrote to memory of 4440 2800 4575.tmp 99 PID 2800 wrote to memory of 4440 2800 4575.tmp 99 PID 4440 wrote to memory of 540 4440 45E2.tmp 100 PID 4440 wrote to memory of 540 4440 45E2.tmp 100 PID 4440 wrote to memory of 540 4440 45E2.tmp 100 PID 540 wrote to memory of 4536 540 4640.tmp 101 PID 540 wrote to memory of 4536 540 4640.tmp 101 PID 540 wrote to memory of 4536 540 4640.tmp 101 PID 4536 wrote to memory of 4604 4536 469E.tmp 102 PID 4536 wrote to memory of 4604 4536 469E.tmp 102 PID 4536 wrote to memory of 4604 4536 469E.tmp 102 PID 4604 wrote to memory of 2992 4604 471B.tmp 103 PID 4604 wrote to memory of 2992 4604 471B.tmp 103 PID 4604 wrote to memory of 2992 4604 471B.tmp 103 PID 2992 wrote to memory of 3440 2992 4769.tmp 104 PID 2992 wrote to memory of 3440 2992 4769.tmp 104 PID 2992 wrote to memory of 3440 2992 4769.tmp 104 PID 3440 wrote to memory of 4740 3440 47C7.tmp 105 PID 3440 wrote to memory of 4740 3440 47C7.tmp 105 PID 3440 wrote to memory of 4740 3440 47C7.tmp 105 PID 4740 wrote to memory of 336 4740 4825.tmp 106 PID 4740 wrote to memory of 336 4740 4825.tmp 106 PID 4740 wrote to memory of 336 4740 4825.tmp 106 PID 336 wrote to memory of 3704 336 4882.tmp 107 PID 336 wrote to memory of 3704 336 4882.tmp 107 PID 336 wrote to memory of 3704 336 4882.tmp 107 PID 3704 wrote to memory of 4876 3704 48F0.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-07_7fd728333125eaa5e0effedc936afb67_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3976 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2992 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"23⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"24⤵
- Executes dropped EXE
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"25⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"26⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"27⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"28⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"29⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"30⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"31⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"32⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"33⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"34⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"35⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"36⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"37⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"38⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"39⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"40⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"41⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"42⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"43⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"44⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"45⤵
- Executes dropped EXE
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"46⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"47⤵
- Executes dropped EXE
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"48⤵
- Executes dropped EXE
PID:4280 -
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"49⤵
- Executes dropped EXE
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"50⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"51⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"52⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"53⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"54⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"55⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"56⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"57⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"58⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"59⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"60⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"61⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"62⤵
- Executes dropped EXE
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"63⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"64⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"65⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"66⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"67⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"68⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"69⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"70⤵PID:3960
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"71⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"72⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"73⤵PID:2808
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"74⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"75⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"76⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"77⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"78⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"79⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"80⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"81⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"82⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"83⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"84⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"85⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"86⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"87⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"88⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"89⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"90⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"91⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"92⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"93⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"94⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"95⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"96⤵PID:4968
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"97⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"98⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"99⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"100⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"101⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"102⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"103⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"104⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"105⤵PID:2592
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"106⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"107⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"108⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"109⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"110⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"111⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"112⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"113⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"114⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"115⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"116⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"117⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"118⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"119⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"120⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"121⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-