Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 18:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe
-
Size
487KB
-
MD5
d0af570dc8218176d9e34777a31aac9c
-
SHA1
22e37ec1ce56f4674fb426c5e36f939cc31654bc
-
SHA256
4c7630ef71dd8d84a41f35dabcd0f46d16ebbff0667f40c7341ad9008d4b6517
-
SHA512
c32e85543eed5352bd94a0e7020794d206af32edda2ca6c1d098e28df9cd1e72c05e374977b4d08728d74ce0f301b61e1160e0dc7774b0381c00cc69fbf01e6e
-
SSDEEP
12288:HU5rCOTeiJMAnb2UMkcDEQMra3zNHFWaFNZ:HUQOJJMC2UZ3r0ljFN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3900 3DD4.tmp 3200 3E41.tmp 1032 3EAF.tmp 4092 3F4B.tmp 4900 3FA9.tmp 1212 4026.tmp 3148 4083.tmp 536 4100.tmp 3792 416E.tmp 3728 41CC.tmp 2224 421A.tmp 2728 4268.tmp 4892 42D5.tmp 4552 4323.tmp 3684 43A0.tmp 4540 43FE.tmp 3484 445C.tmp 1148 44D9.tmp 2356 4556.tmp 4308 45C3.tmp 4516 4631.tmp 4972 46AE.tmp 3920 46FC.tmp 1064 4779.tmp 1392 47D6.tmp 2156 4844.tmp 4824 48A2.tmp 4980 490F.tmp 4180 496D.tmp 1840 49CA.tmp 1012 4A38.tmp 4028 4AA5.tmp 3752 4B22.tmp 2540 4B70.tmp 952 4BBE.tmp 3516 4C1C.tmp 2936 4C6A.tmp 920 4CC8.tmp 3052 4D16.tmp 2420 4D74.tmp 3984 4DD2.tmp 3660 4E20.tmp 628 4E6E.tmp 1188 4EBC.tmp 4064 4F0A.tmp 3160 4F68.tmp 1200 4FB6.tmp 3744 5004.tmp 2304 5052.tmp 5096 50A0.tmp 4768 50FE.tmp 4456 515C.tmp 3088 51AA.tmp 2456 51F8.tmp 3900 5256.tmp 3972 52A4.tmp 4004 52F2.tmp 4364 5350.tmp 3164 539E.tmp 3456 53FC.tmp 3380 544A.tmp 2760 5498.tmp 1552 54E6.tmp 956 5534.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2188 wrote to memory of 3900 2188 2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe 81 PID 2188 wrote to memory of 3900 2188 2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe 81 PID 2188 wrote to memory of 3900 2188 2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe 81 PID 3900 wrote to memory of 3200 3900 3DD4.tmp 82 PID 3900 wrote to memory of 3200 3900 3DD4.tmp 82 PID 3900 wrote to memory of 3200 3900 3DD4.tmp 82 PID 3200 wrote to memory of 1032 3200 3E41.tmp 84 PID 3200 wrote to memory of 1032 3200 3E41.tmp 84 PID 3200 wrote to memory of 1032 3200 3E41.tmp 84 PID 1032 wrote to memory of 4092 1032 3EAF.tmp 86 PID 1032 wrote to memory of 4092 1032 3EAF.tmp 86 PID 1032 wrote to memory of 4092 1032 3EAF.tmp 86 PID 4092 wrote to memory of 4900 4092 3F4B.tmp 88 PID 4092 wrote to memory of 4900 4092 3F4B.tmp 88 PID 4092 wrote to memory of 4900 4092 3F4B.tmp 88 PID 4900 wrote to memory of 1212 4900 3FA9.tmp 89 PID 4900 wrote to memory of 1212 4900 3FA9.tmp 89 PID 4900 wrote to memory of 1212 4900 3FA9.tmp 89 PID 1212 wrote to memory of 3148 1212 4026.tmp 90 PID 1212 wrote to memory of 3148 1212 4026.tmp 90 PID 1212 wrote to memory of 3148 1212 4026.tmp 90 PID 3148 wrote to memory of 536 3148 4083.tmp 91 PID 3148 wrote to memory of 536 3148 4083.tmp 91 PID 3148 wrote to memory of 536 3148 4083.tmp 91 PID 536 wrote to memory of 3792 536 4100.tmp 92 PID 536 wrote to memory of 3792 536 4100.tmp 92 PID 536 wrote to memory of 3792 536 4100.tmp 92 PID 3792 wrote to memory of 3728 3792 416E.tmp 93 PID 3792 wrote to memory of 3728 3792 416E.tmp 93 PID 3792 wrote to memory of 3728 3792 416E.tmp 93 PID 3728 wrote to memory of 2224 3728 41CC.tmp 94 PID 3728 wrote to memory of 2224 3728 41CC.tmp 94 PID 3728 wrote to memory of 2224 3728 41CC.tmp 94 PID 2224 wrote to memory of 2728 2224 421A.tmp 95 PID 2224 wrote to memory of 2728 2224 421A.tmp 95 PID 2224 wrote to memory of 2728 2224 421A.tmp 95 PID 2728 wrote to memory of 4892 2728 4268.tmp 96 PID 2728 wrote to memory of 4892 2728 4268.tmp 96 PID 2728 wrote to memory of 4892 2728 4268.tmp 96 PID 4892 wrote to memory of 4552 4892 42D5.tmp 97 PID 4892 wrote to memory of 4552 4892 42D5.tmp 97 PID 4892 wrote to memory of 4552 4892 42D5.tmp 97 PID 4552 wrote to memory of 3684 4552 4323.tmp 98 PID 4552 wrote to memory of 3684 4552 4323.tmp 98 PID 4552 wrote to memory of 3684 4552 4323.tmp 98 PID 3684 wrote to memory of 4540 3684 43A0.tmp 99 PID 3684 wrote to memory of 4540 3684 43A0.tmp 99 PID 3684 wrote to memory of 4540 3684 43A0.tmp 99 PID 4540 wrote to memory of 3484 4540 43FE.tmp 100 PID 4540 wrote to memory of 3484 4540 43FE.tmp 100 PID 4540 wrote to memory of 3484 4540 43FE.tmp 100 PID 3484 wrote to memory of 1148 3484 445C.tmp 101 PID 3484 wrote to memory of 1148 3484 445C.tmp 101 PID 3484 wrote to memory of 1148 3484 445C.tmp 101 PID 1148 wrote to memory of 2356 1148 44D9.tmp 102 PID 1148 wrote to memory of 2356 1148 44D9.tmp 102 PID 1148 wrote to memory of 2356 1148 44D9.tmp 102 PID 2356 wrote to memory of 4308 2356 4556.tmp 103 PID 2356 wrote to memory of 4308 2356 4556.tmp 103 PID 2356 wrote to memory of 4308 2356 4556.tmp 103 PID 4308 wrote to memory of 4516 4308 45C3.tmp 104 PID 4308 wrote to memory of 4516 4308 45C3.tmp 104 PID 4308 wrote to memory of 4516 4308 45C3.tmp 104 PID 4516 wrote to memory of 4972 4516 4631.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_d0af570dc8218176d9e34777a31aac9c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"C:\Users\Admin\AppData\Local\Temp\3F4B.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3792 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\4323.tmp"C:\Users\Admin\AppData\Local\Temp\4323.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\45C3.tmp"C:\Users\Admin\AppData\Local\Temp\45C3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"23⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"24⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"25⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"26⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"27⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"28⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"29⤵
- Executes dropped EXE
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"30⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"31⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"32⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"33⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"34⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"35⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"36⤵
- Executes dropped EXE
PID:952 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"37⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"38⤵
- Executes dropped EXE
PID:2936 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"39⤵
- Executes dropped EXE
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"40⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"41⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"42⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"43⤵
- Executes dropped EXE
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"44⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"45⤵
- Executes dropped EXE
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"46⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"47⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"48⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"49⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"50⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"51⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"52⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"53⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"54⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"55⤵
- Executes dropped EXE
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"56⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"57⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"58⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"59⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"60⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"61⤵
- Executes dropped EXE
PID:3456 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"62⤵
- Executes dropped EXE
PID:3380 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"63⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"64⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"65⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"66⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"67⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"68⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"69⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"70⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"71⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"72⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"73⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"74⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"75⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"76⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"77⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"78⤵PID:3424
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"79⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"80⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"81⤵PID:2104
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"82⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"83⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"84⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"85⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"86⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"87⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"88⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"89⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"90⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"91⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"92⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"93⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"94⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"95⤵PID:1144
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"96⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"97⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"98⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"99⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"100⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"101⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"102⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"103⤵PID:2540
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"104⤵PID:952
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"105⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"106⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"107⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"108⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"109⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"110⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"111⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"112⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"113⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"114⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"115⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"116⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"117⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"118⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"119⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"120⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"121⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\67F1.tmp"C:\Users\Admin\AppData\Local\Temp\67F1.tmp"122⤵PID:4348
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-