Analysis
- max time kernel
150s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 14:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe
- Size 541KB
- Sample240603-ryqevahf7t
- SHA256 3eea5efda43f9ef66f3fdadcddb772f29260d3db355d4439e69603bb3567c4fe
- MD5 ccd2f4036ab6731ef197fc5536da0d31
- SHA1 171f61a5aba479fd9884a26a64aad28b0d672f40
- SHA512 7b165570f82e37095bf54e648f78336792ba1f73e454498d1792a1ab5627570e0682d9a2690bfd6063739cc61d657ce675126a29c4ca5876bcbbaf861fc0d618
- SSDEEP 12288:UU5rCOTeifIVedfD+XXiRL8CureKyH74OpMgOtsrZa73ctO:UUQOJf39RAZeKVAFSsrU73ctO
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 4444 3A69.tmp 3732 3AD6.tmp 5084 3B63.tmp 3308 3C0F.tmp 4488 3C8C.tmp 4596 3D09.tmp 1328 3D67.tmp 2716 3DE4.tmp 3584 3E41.tmp 1356 3E9F.tmp 116 3F0C.tmp 5096 3F89.tmp 552 3FF7.tmp 2660 4074.tmp 2968 40F1.tmp 4460 413F.tmp 1052 419D.tmp 5080 41FA.tmp 3248 4287.tmp 4192 4304.tmp 2492 4371.tmp 2324 43C0.tmp 4092 441D.tmp 1516 447B.tmp 1844 44C9.tmp 2864 4546.tmp 2004 45B4.tmp 2644 4611.tmp 4856 468E.tmp 5048 470B.tmp 3912 4779.tmp 2168 47F6.tmp 3060 4882.tmp 1472 48E0.tmp 3012 493E.tmp 2128 498C.tmp 1672 49DA.tmp 1700 4A28.tmp 2580 4A76.tmp 4844 4AC4.tmp 5028 4B13.tmp 2172 4B61.tmp 5040 4BAF.tmp 2964 4BFD.tmp 3092 4C4B.tmp 3584 4C99.tmp 2224 4CE7.tmp 2676 4D45.tmp 3192 4DA3.tmp 4548 4E10.tmp 4440 4E5E.tmp 1320 4EAC.tmp 1052 4F0A.tmp 5080 4F58.tmp 876 4FA6.tmp 4616 4FF5.tmp 4192 5052.tmp 1632 50B0.tmp 4260 510E.tmp 3680 516C.tmp 2440 51C9.tmp 3636 5217.tmp 4016 5275.tmp 4080 52C3.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 4444 2672 2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe 82 PID 2672 wrote to memory of 4444 2672 2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe 82 PID 2672 wrote to memory of 4444 2672 2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe 82 PID 4444 wrote to memory of 3732 4444 3A69.tmp 83 PID 4444 wrote to memory of 3732 4444 3A69.tmp 83 PID 4444 wrote to memory of 3732 4444 3A69.tmp 83 PID 3732 wrote to memory of 5084 3732 3AD6.tmp 84 PID 3732 wrote to memory of 5084 3732 3AD6.tmp 84 PID 3732 wrote to memory of 5084 3732 3AD6.tmp 84 PID 5084 wrote to memory of 3308 5084 3B63.tmp 86 PID 5084 wrote to memory of 3308 5084 3B63.tmp 86 PID 5084 wrote to memory of 3308 5084 3B63.tmp 86 PID 3308 wrote to memory of 4488 3308 3C0F.tmp 88 PID 3308 wrote to memory of 4488 3308 3C0F.tmp 88 PID 3308 wrote to memory of 4488 3308 3C0F.tmp 88 PID 4488 wrote to memory of 4596 4488 3C8C.tmp 89 PID 4488 wrote to memory of 4596 4488 3C8C.tmp 89 PID 4488 wrote to memory of 4596 4488 3C8C.tmp 89 PID 4596 wrote to memory of 1328 4596 3D09.tmp 91 PID 4596 wrote to memory of 1328 4596 3D09.tmp 91 PID 4596 wrote to memory of 1328 4596 3D09.tmp 91 PID 1328 wrote to memory of 2716 1328 3D67.tmp 92 PID 1328 wrote to memory of 2716 1328 3D67.tmp 92 PID 1328 wrote to memory of 2716 1328 3D67.tmp 92 PID 2716 wrote to memory of 3584 2716 3DE4.tmp 93 PID 2716 wrote to memory of 3584 2716 3DE4.tmp 93 PID 2716 wrote to memory of 3584 2716 3DE4.tmp 93 PID 3584 wrote to memory of 1356 3584 3E41.tmp 94 PID 3584 wrote to memory of 1356 3584 3E41.tmp 94 PID 3584 wrote to memory of 1356 3584 3E41.tmp 94 PID 1356 wrote to memory of 116 1356 3E9F.tmp 95 PID 1356 wrote to memory of 116 1356 3E9F.tmp 95 PID 1356 wrote to memory of 116 1356 3E9F.tmp 95 PID 116 wrote to memory of 5096 116 3F0C.tmp 96 PID 116 wrote to memory of 5096 116 3F0C.tmp 96 PID 116 wrote to memory of 5096 116 3F0C.tmp 96 PID 5096 wrote to memory of 552 5096 3F89.tmp 97 PID 5096 wrote to memory of 552 5096 3F89.tmp 97 PID 5096 wrote to memory of 552 5096 3F89.tmp 97 PID 552 wrote to memory of 2660 552 3FF7.tmp 98 PID 552 wrote to memory of 2660 552 3FF7.tmp 98 PID 552 wrote to memory of 2660 552 3FF7.tmp 98 PID 2660 wrote to memory of 2968 2660 4074.tmp 99 PID 2660 wrote to memory of 2968 2660 4074.tmp 99 PID 2660 wrote to memory of 2968 2660 4074.tmp 99 PID 2968 wrote to memory of 4460 2968 40F1.tmp 100 PID 2968 wrote to memory of 4460 2968 40F1.tmp 100 PID 2968 wrote to memory of 4460 2968 40F1.tmp 100 PID 4460 wrote to memory of 1052 4460 413F.tmp 101 PID 4460 wrote to memory of 1052 4460 413F.tmp 101 PID 4460 wrote to memory of 1052 4460 413F.tmp 101 PID 1052 wrote to memory of 5080 1052 419D.tmp 102 PID 1052 wrote to memory of 5080 1052 419D.tmp 102 PID 1052 wrote to memory of 5080 1052 419D.tmp 102 PID 5080 wrote to memory of 3248 5080 41FA.tmp 103 PID 5080 wrote to memory of 3248 5080 41FA.tmp 103 PID 5080 wrote to memory of 3248 5080 41FA.tmp 103 PID 3248 wrote to memory of 4192 3248 4287.tmp 104 PID 3248 wrote to memory of 4192 3248 4287.tmp 104 PID 3248 wrote to memory of 4192 3248 4287.tmp 104 PID 4192 wrote to memory of 2492 4192 4304.tmp 105 PID 4192 wrote to memory of 2492 4192 4304.tmp 105 PID 4192 wrote to memory of 2492 4192 4304.tmp 105 PID 2492 wrote to memory of 2324 2492 4371.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_ccd2f4036ab6731ef197fc5536da0d31_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\3B63.tmp"C:\Users\Admin\AppData\Local\Temp\3B63.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4287.tmp"C:\Users\Admin\AppData\Local\Temp\4287.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4371.tmp"C:\Users\Admin\AppData\Local\Temp\4371.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"23⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"24⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"25⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"26⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"27⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"28⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"29⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"30⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"31⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"32⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"33⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"34⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"35⤵
- Executes dropped EXE
PID:1472 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"36⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"37⤵
- Executes dropped EXE
PID:2128 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"38⤵
- Executes dropped EXE
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"39⤵
- Executes dropped EXE
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"40⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"41⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"42⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"43⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"44⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"45⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"46⤵
- Executes dropped EXE
PID:3092 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"47⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"48⤵
- Executes dropped EXE
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"49⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"50⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"51⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"52⤵
- Executes dropped EXE
PID:4440 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"53⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"54⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"55⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"56⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"57⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"58⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"59⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"60⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"61⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"62⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"63⤵
- Executes dropped EXE
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"64⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"65⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"66⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"67⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"68⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"69⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"70⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"71⤵PID:4340
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"72⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"73⤵PID:1340
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"74⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"75⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"76⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"77⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"78⤵PID:3916
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"79⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"80⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"81⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"82⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"83⤵PID:3200
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"84⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"85⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"86⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"87⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"88⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"89⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"90⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"91⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"92⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"93⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"94⤵PID:552
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"95⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"96⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"97⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"98⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"99⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"100⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"101⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"102⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"103⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"104⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"105⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"106⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"107⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"108⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"109⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"110⤵PID:2608
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"111⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"112⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"113⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"114⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"115⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"116⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"117⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"118⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"119⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"120⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"121⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"122⤵PID:3100
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-