Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 09:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe
-
Size
520KB
-
MD5
8d56d25ad354a3f03d72ca71a05ab496
-
SHA1
57276c7e74b3169b5184ddbf17384bcd815c5d81
-
SHA256
af0de0f739a79acfe16193286ba8b8eb67d21b5100f4c488b61c44172e7c4edf
-
SHA512
0415e1813c694bd8e9962dcde69692562711f13041ee507068c66dcd63cb589fd0caecbe5f89461228e45682d1fac36fee92781346f6f588f85e5669669fa2ee
-
SSDEEP
12288:gj8fuxR21t5i8f0ReAK58JLRNE2es61ZxyNa5HwNZ:gj8fuK1GYRAKKL2Hvua5HwN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4612 37D9.tmp 1912 3856.tmp 4616 38A4.tmp 560 3902.tmp 3196 3950.tmp 508 39AD.tmp 5052 3A0B.tmp 3988 3A69.tmp 4060 3B05.tmp 3696 3B53.tmp 3560 3BA1.tmp 2528 3BF0.tmp 3596 3C8C.tmp 2024 3CDA.tmp 4936 3D28.tmp 5068 3D86.tmp 1216 3DF3.tmp 4568 3E41.tmp 4412 3E8F.tmp 4988 3EDE.tmp 5056 3F3B.tmp 1768 3F89.tmp 3032 3FD8.tmp 2772 4026.tmp 3296 4083.tmp 3384 40E1.tmp 3936 413F.tmp 4488 419D.tmp 4596 41FA.tmp 1588 4258.tmp 5048 42B6.tmp 1036 4304.tmp 4480 4352.tmp 3256 43A0.tmp 2668 440E.tmp 2328 446B.tmp 1848 44BA.tmp 1156 4508.tmp 2228 4556.tmp 2784 45A4.tmp 1524 45F2.tmp 3712 4650.tmp 4912 469E.tmp 2704 46EC.tmp 464 473A.tmp 3672 4788.tmp 1264 47D6.tmp 4720 4825.tmp 5032 4873.tmp 1840 48C1.tmp 4192 48FF.tmp 2972 493E.tmp 2560 497C.tmp 4456 49CA.tmp 1620 4A09.tmp 5108 4A47.tmp 2764 4A96.tmp 4476 4AD4.tmp 4992 4B22.tmp 1708 4B70.tmp 2216 4BBE.tmp 1480 4C0D.tmp 4852 4C5B.tmp 3196 4CA9.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4208 wrote to memory of 4612 4208 2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe 80 PID 4208 wrote to memory of 4612 4208 2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe 80 PID 4208 wrote to memory of 4612 4208 2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe 80 PID 4612 wrote to memory of 1912 4612 37D9.tmp 81 PID 4612 wrote to memory of 1912 4612 37D9.tmp 81 PID 4612 wrote to memory of 1912 4612 37D9.tmp 81 PID 1912 wrote to memory of 4616 1912 3856.tmp 82 PID 1912 wrote to memory of 4616 1912 3856.tmp 82 PID 1912 wrote to memory of 4616 1912 3856.tmp 82 PID 4616 wrote to memory of 560 4616 38A4.tmp 83 PID 4616 wrote to memory of 560 4616 38A4.tmp 83 PID 4616 wrote to memory of 560 4616 38A4.tmp 83 PID 560 wrote to memory of 3196 560 3902.tmp 147 PID 560 wrote to memory of 3196 560 3902.tmp 147 PID 560 wrote to memory of 3196 560 3902.tmp 147 PID 3196 wrote to memory of 508 3196 3950.tmp 85 PID 3196 wrote to memory of 508 3196 3950.tmp 85 PID 3196 wrote to memory of 508 3196 3950.tmp 85 PID 508 wrote to memory of 5052 508 39AD.tmp 86 PID 508 wrote to memory of 5052 508 39AD.tmp 86 PID 508 wrote to memory of 5052 508 39AD.tmp 86 PID 5052 wrote to memory of 3988 5052 3A0B.tmp 87 PID 5052 wrote to memory of 3988 5052 3A0B.tmp 87 PID 5052 wrote to memory of 3988 5052 3A0B.tmp 87 PID 3988 wrote to memory of 4060 3988 3A69.tmp 88 PID 3988 wrote to memory of 4060 3988 3A69.tmp 88 PID 3988 wrote to memory of 4060 3988 3A69.tmp 88 PID 4060 wrote to memory of 3696 4060 3B05.tmp 89 PID 4060 wrote to memory of 3696 4060 3B05.tmp 89 PID 4060 wrote to memory of 3696 4060 3B05.tmp 89 PID 3696 wrote to memory of 3560 3696 3B53.tmp 90 PID 3696 wrote to memory of 3560 3696 3B53.tmp 90 PID 3696 wrote to memory of 3560 3696 3B53.tmp 90 PID 3560 wrote to memory of 2528 3560 3BA1.tmp 157 PID 3560 wrote to memory of 2528 3560 3BA1.tmp 157 PID 3560 wrote to memory of 2528 3560 3BA1.tmp 157 PID 2528 wrote to memory of 3596 2528 3BF0.tmp 92 PID 2528 wrote to memory of 3596 2528 3BF0.tmp 92 PID 2528 wrote to memory of 3596 2528 3BF0.tmp 92 PID 3596 wrote to memory of 2024 3596 3C8C.tmp 93 PID 3596 wrote to memory of 2024 3596 3C8C.tmp 93 PID 3596 wrote to memory of 2024 3596 3C8C.tmp 93 PID 2024 wrote to memory of 4936 2024 3CDA.tmp 94 PID 2024 wrote to memory of 4936 2024 3CDA.tmp 94 PID 2024 wrote to memory of 4936 2024 3CDA.tmp 94 PID 4936 wrote to memory of 5068 4936 3D28.tmp 95 PID 4936 wrote to memory of 5068 4936 3D28.tmp 95 PID 4936 wrote to memory of 5068 4936 3D28.tmp 95 PID 5068 wrote to memory of 1216 5068 3D86.tmp 96 PID 5068 wrote to memory of 1216 5068 3D86.tmp 96 PID 5068 wrote to memory of 1216 5068 3D86.tmp 96 PID 1216 wrote to memory of 4568 1216 3DF3.tmp 97 PID 1216 wrote to memory of 4568 1216 3DF3.tmp 97 PID 1216 wrote to memory of 4568 1216 3DF3.tmp 97 PID 4568 wrote to memory of 4412 4568 3E41.tmp 98 PID 4568 wrote to memory of 4412 4568 3E41.tmp 98 PID 4568 wrote to memory of 4412 4568 3E41.tmp 98 PID 4412 wrote to memory of 4988 4412 3E8F.tmp 99 PID 4412 wrote to memory of 4988 4412 3E8F.tmp 99 PID 4412 wrote to memory of 4988 4412 3E8F.tmp 99 PID 4988 wrote to memory of 5056 4988 3EDE.tmp 100 PID 4988 wrote to memory of 5056 4988 3EDE.tmp 100 PID 4988 wrote to memory of 5056 4988 3EDE.tmp 100 PID 5056 wrote to memory of 1768 5056 3F3B.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_8d56d25ad354a3f03d72ca71a05ab496_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\37D9.tmp"C:\Users\Admin\AppData\Local\Temp\37D9.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\3902.tmp"C:\Users\Admin\AppData\Local\Temp\3902.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\3950.tmp"C:\Users\Admin\AppData\Local\Temp\3950.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"23⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"24⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"25⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"26⤵
- Executes dropped EXE
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"27⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"28⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"29⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"30⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"31⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"32⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"33⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"34⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"35⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"36⤵
- Executes dropped EXE
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"37⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"38⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4508.tmp"C:\Users\Admin\AppData\Local\Temp\4508.tmp"39⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"40⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"41⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"42⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"43⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"44⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"45⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"46⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"47⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"48⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"49⤵
- Executes dropped EXE
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"50⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"51⤵
- Executes dropped EXE
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"52⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"53⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"54⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"55⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"56⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"57⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4A96.tmp"C:\Users\Admin\AppData\Local\Temp\4A96.tmp"58⤵
- Executes dropped EXE
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"59⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"60⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"61⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"62⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"63⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"64⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"65⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"66⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"67⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"68⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"69⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"70⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"71⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"72⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"73⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"74⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"75⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"76⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"77⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"78⤵PID:2376
-
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"79⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"80⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"81⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"82⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"83⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"84⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"85⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"86⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"87⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"88⤵PID:2620
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"89⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"90⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"91⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"92⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"93⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"94⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"95⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"96⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"97⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"98⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"99⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"100⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"101⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"102⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"103⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"105⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"106⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"107⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"108⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"109⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"110⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"111⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"112⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"113⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"114⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"115⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"116⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"117⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"118⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"119⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"120⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"121⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"122⤵PID:3080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-