Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 17:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe
-
Size
529KB
-
MD5
570a8ffc8fa90f9dd500e28032aae5b5
-
SHA1
d1cde0f3f6122dbca8502af62d04de8c63a27be7
-
SHA256
38167c4bd4b52f24be266dd86976a8c909fc998cfdcf47b6239274b7089251cf
-
SHA512
155457f3c15d30fd7fea7dc7d07bf347f675f8ad00320a1c97f4b47c541042226ae1c7fcf83d3101bdadf36281d742ae0a5d22513ec2e1cf836ad0a7eeb0964f
-
SSDEEP
12288:NU5rCOTeijd2VQXcTOin25+G0PnNGzPQP8E3TZwlH4Hp:NUQOJjddX1p5bWEzPQP8CTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2540 3364.tmp 1920 33C2.tmp 1412 344E.tmp 4312 34DB.tmp 1596 3548.tmp 1752 35A6.tmp 1948 3623.tmp 4516 3671.tmp 2456 36EE.tmp 4748 375C.tmp 4388 37C9.tmp 2036 3846.tmp 464 38C3.tmp 4088 3921.tmp 3212 398E.tmp 2820 3A0B.tmp 1988 3A59.tmp 4352 3AB7.tmp 5028 3B05.tmp 1568 3B53.tmp 1936 3BD0.tmp 640 3C4D.tmp 3716 3CBB.tmp 4268 3D18.tmp 3164 3DA5.tmp 4960 3E22.tmp 1368 3E80.tmp 968 3EED.tmp 4076 3F3B.tmp 948 3F99.tmp 2740 3FE7.tmp 2612 4045.tmp 224 4093.tmp 2288 40F1.tmp 1000 413F.tmp 3416 419D.tmp 1440 41FA.tmp 4136 4258.tmp 4492 42A6.tmp 548 42F4.tmp 2020 4343.tmp 1044 43A0.tmp 1544 43EE.tmp 1964 443D.tmp 2000 448B.tmp 4516 44E8.tmp 3472 4537.tmp 3240 4585.tmp 3500 45E2.tmp 3104 4640.tmp 1056 468E.tmp 4296 46EC.tmp 4088 473A.tmp 2576 4788.tmp 3952 47D6.tmp 3772 4834.tmp 4324 4892.tmp 1080 48E0.tmp 1304 493E.tmp 4660 499C.tmp 1356 4A09.tmp 1644 4A67.tmp 4072 4AD4.tmp 1512 4B22.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4920 wrote to memory of 2540 4920 2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe 84 PID 4920 wrote to memory of 2540 4920 2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe 84 PID 4920 wrote to memory of 2540 4920 2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe 84 PID 2540 wrote to memory of 1920 2540 3364.tmp 85 PID 2540 wrote to memory of 1920 2540 3364.tmp 85 PID 2540 wrote to memory of 1920 2540 3364.tmp 85 PID 1920 wrote to memory of 1412 1920 33C2.tmp 88 PID 1920 wrote to memory of 1412 1920 33C2.tmp 88 PID 1920 wrote to memory of 1412 1920 33C2.tmp 88 PID 1412 wrote to memory of 4312 1412 344E.tmp 89 PID 1412 wrote to memory of 4312 1412 344E.tmp 89 PID 1412 wrote to memory of 4312 1412 344E.tmp 89 PID 4312 wrote to memory of 1596 4312 34DB.tmp 91 PID 4312 wrote to memory of 1596 4312 34DB.tmp 91 PID 4312 wrote to memory of 1596 4312 34DB.tmp 91 PID 1596 wrote to memory of 1752 1596 3548.tmp 92 PID 1596 wrote to memory of 1752 1596 3548.tmp 92 PID 1596 wrote to memory of 1752 1596 3548.tmp 92 PID 1752 wrote to memory of 1948 1752 35A6.tmp 93 PID 1752 wrote to memory of 1948 1752 35A6.tmp 93 PID 1752 wrote to memory of 1948 1752 35A6.tmp 93 PID 1948 wrote to memory of 4516 1948 3623.tmp 95 PID 1948 wrote to memory of 4516 1948 3623.tmp 95 PID 1948 wrote to memory of 4516 1948 3623.tmp 95 PID 4516 wrote to memory of 2456 4516 3671.tmp 96 PID 4516 wrote to memory of 2456 4516 3671.tmp 96 PID 4516 wrote to memory of 2456 4516 3671.tmp 96 PID 2456 wrote to memory of 4748 2456 36EE.tmp 97 PID 2456 wrote to memory of 4748 2456 36EE.tmp 97 PID 2456 wrote to memory of 4748 2456 36EE.tmp 97 PID 4748 wrote to memory of 4388 4748 375C.tmp 98 PID 4748 wrote to memory of 4388 4748 375C.tmp 98 PID 4748 wrote to memory of 4388 4748 375C.tmp 98 PID 4388 wrote to memory of 2036 4388 37C9.tmp 99 PID 4388 wrote to memory of 2036 4388 37C9.tmp 99 PID 4388 wrote to memory of 2036 4388 37C9.tmp 99 PID 2036 wrote to memory of 464 2036 3846.tmp 100 PID 2036 wrote to memory of 464 2036 3846.tmp 100 PID 2036 wrote to memory of 464 2036 3846.tmp 100 PID 464 wrote to memory of 4088 464 38C3.tmp 101 PID 464 wrote to memory of 4088 464 38C3.tmp 101 PID 464 wrote to memory of 4088 464 38C3.tmp 101 PID 4088 wrote to memory of 3212 4088 3921.tmp 102 PID 4088 wrote to memory of 3212 4088 3921.tmp 102 PID 4088 wrote to memory of 3212 4088 3921.tmp 102 PID 3212 wrote to memory of 2820 3212 398E.tmp 103 PID 3212 wrote to memory of 2820 3212 398E.tmp 103 PID 3212 wrote to memory of 2820 3212 398E.tmp 103 PID 2820 wrote to memory of 1988 2820 3A0B.tmp 104 PID 2820 wrote to memory of 1988 2820 3A0B.tmp 104 PID 2820 wrote to memory of 1988 2820 3A0B.tmp 104 PID 1988 wrote to memory of 4352 1988 3A59.tmp 105 PID 1988 wrote to memory of 4352 1988 3A59.tmp 105 PID 1988 wrote to memory of 4352 1988 3A59.tmp 105 PID 4352 wrote to memory of 5028 4352 3AB7.tmp 106 PID 4352 wrote to memory of 5028 4352 3AB7.tmp 106 PID 4352 wrote to memory of 5028 4352 3AB7.tmp 106 PID 5028 wrote to memory of 1568 5028 3B05.tmp 107 PID 5028 wrote to memory of 1568 5028 3B05.tmp 107 PID 5028 wrote to memory of 1568 5028 3B05.tmp 107 PID 1568 wrote to memory of 1936 1568 3B53.tmp 108 PID 1568 wrote to memory of 1936 1568 3B53.tmp 108 PID 1568 wrote to memory of 1936 1568 3B53.tmp 108 PID 1936 wrote to memory of 640 1936 3BD0.tmp 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_570a8ffc8fa90f9dd500e28032aae5b5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\3364.tmp"C:\Users\Admin\AppData\Local\Temp\3364.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Users\Admin\AppData\Local\Temp\34DB.tmp"C:\Users\Admin\AppData\Local\Temp\34DB.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3548.tmp"C:\Users\Admin\AppData\Local\Temp\3548.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\3846.tmp"C:\Users\Admin\AppData\Local\Temp\3846.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"23⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"24⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"25⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"C:\Users\Admin\AppData\Local\Temp\3DA5.tmp"26⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"27⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"28⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"29⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"30⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"31⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"32⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"33⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"34⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"35⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"36⤵
- Executes dropped EXE
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"37⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"38⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"39⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"40⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"41⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"42⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"43⤵
- Executes dropped EXE
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"44⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"45⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"46⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"47⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"48⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"49⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"50⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"51⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"52⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"53⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"54⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"55⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"56⤵
- Executes dropped EXE
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"57⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"58⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"59⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"60⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"61⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"62⤵
- Executes dropped EXE
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"63⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"64⤵
- Executes dropped EXE
PID:4072 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"65⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"66⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"67⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"68⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"69⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"70⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"71⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"72⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"73⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"74⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"75⤵PID:3620
-
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"76⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"77⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"78⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"79⤵PID:2468
-
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"80⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"81⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"82⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"83⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"84⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"85⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"86⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"87⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"88⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"89⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"90⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"91⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"92⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"93⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"94⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"95⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"96⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"97⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"98⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"99⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"100⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"101⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"102⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"103⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"104⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"105⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"106⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"107⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"108⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"109⤵PID:2728
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"110⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"111⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"112⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"113⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"114⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"115⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"116⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"117⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"118⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"119⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"120⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"121⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"122⤵PID:1932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-