Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 11:55
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe
-
Size
541KB
-
MD5
ada6306c735c9905c569b50e2685a9f2
-
SHA1
1aac6efb3d878f76f7b01bd7fbba3f2ee5523d0d
-
SHA256
fff03914733bb6568695a02d009fea9630ea2b206fdda52bd94c7abd9061ce6a
-
SHA512
b17e76666691766bfd83d4ceb1413f55ae361526f619fcef1efcf4eb05306db34328a0ceca00919716c6d3302a57b1b3ee5afa445be55826020993628ac21c94
-
SSDEEP
12288:UU5rCOTeif1qqvPo/zPb8Arh2JEAeXSMLrZa73ctO:UUQOJfZvPeSTErU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2772 321C.tmp 1716 32A9.tmp 1000 3326.tmp 4196 3383.tmp 4020 33E1.tmp 4732 345E.tmp 3916 34AC.tmp 1524 350A.tmp 4296 3558.tmp 2580 35B6.tmp 2332 3604.tmp 5116 3681.tmp 3264 36EE.tmp 1556 374C.tmp 4460 379A.tmp 5052 3817.tmp 1068 3865.tmp 1220 38E2.tmp 2732 3950.tmp 2900 399E.tmp 392 39EC.tmp 5092 3A59.tmp 2888 3AC7.tmp 996 3B44.tmp 3612 3BA1.tmp 3824 3C0F.tmp 4260 3C6D.tmp 4380 3CBB.tmp 3412 3D09.tmp 4556 3D76.tmp 4628 3DC4.tmp 3260 3E32.tmp 744 3E8F.tmp 3676 3EED.tmp 2420 3F4B.tmp 2868 3FA9.tmp 1128 3FF7.tmp 1336 4064.tmp 3516 40B2.tmp 2736 4110.tmp 3648 415E.tmp 3364 41AC.tmp 4868 41FA.tmp 848 4258.tmp 4436 42A6.tmp 2716 42F4.tmp 2580 4343.tmp 2372 43A0.tmp 2408 43EE.tmp 4604 444C.tmp 4884 44AA.tmp 1248 4508.tmp 4792 4556.tmp 4500 45B4.tmp 4304 4611.tmp 3932 465F.tmp 3912 46BD.tmp 1220 471B.tmp 2448 4779.tmp 636 47D6.tmp 3544 4834.tmp 3968 4882.tmp 4040 48D0.tmp 5092 492E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2176 wrote to memory of 2772 2176 2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe 82 PID 2176 wrote to memory of 2772 2176 2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe 82 PID 2176 wrote to memory of 2772 2176 2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe 82 PID 2772 wrote to memory of 1716 2772 321C.tmp 83 PID 2772 wrote to memory of 1716 2772 321C.tmp 83 PID 2772 wrote to memory of 1716 2772 321C.tmp 83 PID 1716 wrote to memory of 1000 1716 32A9.tmp 85 PID 1716 wrote to memory of 1000 1716 32A9.tmp 85 PID 1716 wrote to memory of 1000 1716 32A9.tmp 85 PID 1000 wrote to memory of 4196 1000 3326.tmp 86 PID 1000 wrote to memory of 4196 1000 3326.tmp 86 PID 1000 wrote to memory of 4196 1000 3326.tmp 86 PID 4196 wrote to memory of 4020 4196 3383.tmp 88 PID 4196 wrote to memory of 4020 4196 3383.tmp 88 PID 4196 wrote to memory of 4020 4196 3383.tmp 88 PID 4020 wrote to memory of 4732 4020 33E1.tmp 90 PID 4020 wrote to memory of 4732 4020 33E1.tmp 90 PID 4020 wrote to memory of 4732 4020 33E1.tmp 90 PID 4732 wrote to memory of 3916 4732 345E.tmp 91 PID 4732 wrote to memory of 3916 4732 345E.tmp 91 PID 4732 wrote to memory of 3916 4732 345E.tmp 91 PID 3916 wrote to memory of 1524 3916 34AC.tmp 92 PID 3916 wrote to memory of 1524 3916 34AC.tmp 92 PID 3916 wrote to memory of 1524 3916 34AC.tmp 92 PID 1524 wrote to memory of 4296 1524 350A.tmp 93 PID 1524 wrote to memory of 4296 1524 350A.tmp 93 PID 1524 wrote to memory of 4296 1524 350A.tmp 93 PID 4296 wrote to memory of 2580 4296 3558.tmp 94 PID 4296 wrote to memory of 2580 4296 3558.tmp 94 PID 4296 wrote to memory of 2580 4296 3558.tmp 94 PID 2580 wrote to memory of 2332 2580 35B6.tmp 95 PID 2580 wrote to memory of 2332 2580 35B6.tmp 95 PID 2580 wrote to memory of 2332 2580 35B6.tmp 95 PID 2332 wrote to memory of 5116 2332 3604.tmp 96 PID 2332 wrote to memory of 5116 2332 3604.tmp 96 PID 2332 wrote to memory of 5116 2332 3604.tmp 96 PID 5116 wrote to memory of 3264 5116 3681.tmp 97 PID 5116 wrote to memory of 3264 5116 3681.tmp 97 PID 5116 wrote to memory of 3264 5116 3681.tmp 97 PID 3264 wrote to memory of 1556 3264 36EE.tmp 98 PID 3264 wrote to memory of 1556 3264 36EE.tmp 98 PID 3264 wrote to memory of 1556 3264 36EE.tmp 98 PID 1556 wrote to memory of 4460 1556 374C.tmp 99 PID 1556 wrote to memory of 4460 1556 374C.tmp 99 PID 1556 wrote to memory of 4460 1556 374C.tmp 99 PID 4460 wrote to memory of 5052 4460 379A.tmp 100 PID 4460 wrote to memory of 5052 4460 379A.tmp 100 PID 4460 wrote to memory of 5052 4460 379A.tmp 100 PID 5052 wrote to memory of 1068 5052 3817.tmp 101 PID 5052 wrote to memory of 1068 5052 3817.tmp 101 PID 5052 wrote to memory of 1068 5052 3817.tmp 101 PID 1068 wrote to memory of 1220 1068 3865.tmp 102 PID 1068 wrote to memory of 1220 1068 3865.tmp 102 PID 1068 wrote to memory of 1220 1068 3865.tmp 102 PID 1220 wrote to memory of 2732 1220 38E2.tmp 103 PID 1220 wrote to memory of 2732 1220 38E2.tmp 103 PID 1220 wrote to memory of 2732 1220 38E2.tmp 103 PID 2732 wrote to memory of 2900 2732 3950.tmp 104 PID 2732 wrote to memory of 2900 2732 3950.tmp 104 PID 2732 wrote to memory of 2900 2732 3950.tmp 104 PID 2900 wrote to memory of 392 2900 399E.tmp 105 PID 2900 wrote to memory of 392 2900 399E.tmp 105 PID 2900 wrote to memory of 392 2900 399E.tmp 105 PID 392 wrote to memory of 5092 392 39EC.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_ada6306c735c9905c569b50e2685a9f2_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\321C.tmp"C:\Users\Admin\AppData\Local\Temp\321C.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\32A9.tmp"C:\Users\Admin\AppData\Local\Temp\32A9.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\3326.tmp"C:\Users\Admin\AppData\Local\Temp\3326.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\33E1.tmp"C:\Users\Admin\AppData\Local\Temp\33E1.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\345E.tmp"C:\Users\Admin\AppData\Local\Temp\345E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\3558.tmp"C:\Users\Admin\AppData\Local\Temp\3558.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\379A.tmp"C:\Users\Admin\AppData\Local\Temp\379A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\3817.tmp"C:\Users\Admin\AppData\Local\Temp\3817.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\399E.tmp"C:\Users\Admin\AppData\Local\Temp\399E.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"23⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"24⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"25⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"26⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"27⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"C:\Users\Admin\AppData\Local\Temp\3C6D.tmp"28⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"29⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"30⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"31⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"32⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"33⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"34⤵
- Executes dropped EXE
PID:744 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"35⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"36⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"37⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"38⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"39⤵
- Executes dropped EXE
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"40⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"41⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\415E.tmp"C:\Users\Admin\AppData\Local\Temp\415E.tmp"42⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"43⤵
- Executes dropped EXE
PID:3364 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"44⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"45⤵
- Executes dropped EXE
PID:848 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"46⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"47⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"48⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"49⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"50⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"51⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"52⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"53⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"54⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"55⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"56⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"57⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"58⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"59⤵
- Executes dropped EXE
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"60⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"61⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"62⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"63⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"64⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"65⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"66⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"67⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"68⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"69⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"70⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"71⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"72⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"73⤵PID:928
-
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"74⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"75⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"76⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"77⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"78⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"79⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"80⤵PID:244
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"81⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"82⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"83⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"84⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"85⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\5091.tmp"C:\Users\Admin\AppData\Local\Temp\5091.tmp"86⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"87⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"88⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"89⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"90⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"91⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\52D3.tmp"C:\Users\Admin\AppData\Local\Temp\52D3.tmp"92⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"93⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"94⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"95⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"96⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"97⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"98⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"99⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"100⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"101⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"102⤵PID:3952
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"103⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"104⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"105⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"106⤵PID:3096
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"107⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"108⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"109⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"110⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"111⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"112⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"113⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"114⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"115⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"116⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"117⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"118⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"119⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"120⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"121⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"122⤵PID:392
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-