Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2024 06:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe
-
Size
486KB
-
MD5
ca74206ded105ad061bd42ef07724e46
-
SHA1
c973034616008cc0b390887ea1891644b0bf001b
-
SHA256
f9855d3b41c64f1a8ea4239be885ca5f7814dcf50504cbc1212d94be94b8ba6b
-
SHA512
a59bb88e60671823855dc1667a41b3bbc5dc26f60d69a2c396a89585dc64b410fbf60a93df4fda0de083ee576e8df1bb9b037503e4115d814e009e2f71565058
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD780/U9FS1jmDUsyDdZaKTy03KEVe8narOigql:/U5rCOTeiDV/SwsUsETaIlK6e8hnoNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1976 49CA.tmp 3932 4A47.tmp 4316 4AA5.tmp 1984 4B32.tmp 3584 4B9F.tmp 3804 4C0D.tmp 4104 4C7A.tmp 4020 4CC8.tmp 2920 4D35.tmp 3948 4DA3.tmp 1140 4DF1.tmp 3648 4E5E.tmp 3764 4EAC.tmp 2020 4EFB.tmp 2928 4F58.tmp 2600 4FC6.tmp 4812 5014.tmp 1476 5072.tmp 2240 50DF.tmp 3508 514C.tmp 4388 51BA.tmp 2440 5217.tmp 4528 5285.tmp 3828 52F2.tmp 4392 5360.tmp 4136 53AE.tmp 448 540B.tmp 1980 5479.tmp 5008 54E6.tmp 4924 5544.tmp 2160 55A2.tmp 1528 560F.tmp 3344 566D.tmp 2332 56BB.tmp 3240 5719.tmp 1296 5767.tmp 3404 57C5.tmp 1568 5813.tmp 2196 5861.tmp 3388 58AF.tmp 2100 58FD.tmp 4868 594B.tmp 1428 5999.tmp 2296 59E7.tmp 4544 5A36.tmp 2648 5A93.tmp 1088 5AE1.tmp 4396 5B3F.tmp 4276 5B9D.tmp 2772 5BEB.tmp 2272 5C49.tmp 2988 5C97.tmp 2944 5CE5.tmp 4196 5D43.tmp 4352 5D91.tmp 3020 5DDF.tmp 1056 5E3D.tmp 1460 5E8B.tmp 5028 5ED9.tmp 2176 5F27.tmp 1084 5F75.tmp 1216 5FC3.tmp 3232 6002.tmp 388 6050.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1976 1960 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 85 PID 1960 wrote to memory of 1976 1960 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 85 PID 1960 wrote to memory of 1976 1960 2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe 85 PID 1976 wrote to memory of 3932 1976 49CA.tmp 86 PID 1976 wrote to memory of 3932 1976 49CA.tmp 86 PID 1976 wrote to memory of 3932 1976 49CA.tmp 86 PID 3932 wrote to memory of 4316 3932 4A47.tmp 87 PID 3932 wrote to memory of 4316 3932 4A47.tmp 87 PID 3932 wrote to memory of 4316 3932 4A47.tmp 87 PID 4316 wrote to memory of 1984 4316 4AA5.tmp 88 PID 4316 wrote to memory of 1984 4316 4AA5.tmp 88 PID 4316 wrote to memory of 1984 4316 4AA5.tmp 88 PID 1984 wrote to memory of 3584 1984 4B32.tmp 89 PID 1984 wrote to memory of 3584 1984 4B32.tmp 89 PID 1984 wrote to memory of 3584 1984 4B32.tmp 89 PID 3584 wrote to memory of 3804 3584 4B9F.tmp 90 PID 3584 wrote to memory of 3804 3584 4B9F.tmp 90 PID 3584 wrote to memory of 3804 3584 4B9F.tmp 90 PID 3804 wrote to memory of 4104 3804 4C0D.tmp 91 PID 3804 wrote to memory of 4104 3804 4C0D.tmp 91 PID 3804 wrote to memory of 4104 3804 4C0D.tmp 91 PID 4104 wrote to memory of 4020 4104 4C7A.tmp 92 PID 4104 wrote to memory of 4020 4104 4C7A.tmp 92 PID 4104 wrote to memory of 4020 4104 4C7A.tmp 92 PID 4020 wrote to memory of 2920 4020 4CC8.tmp 93 PID 4020 wrote to memory of 2920 4020 4CC8.tmp 93 PID 4020 wrote to memory of 2920 4020 4CC8.tmp 93 PID 2920 wrote to memory of 3948 2920 4D35.tmp 94 PID 2920 wrote to memory of 3948 2920 4D35.tmp 94 PID 2920 wrote to memory of 3948 2920 4D35.tmp 94 PID 3948 wrote to memory of 1140 3948 4DA3.tmp 95 PID 3948 wrote to memory of 1140 3948 4DA3.tmp 95 PID 3948 wrote to memory of 1140 3948 4DA3.tmp 95 PID 1140 wrote to memory of 3648 1140 4DF1.tmp 96 PID 1140 wrote to memory of 3648 1140 4DF1.tmp 96 PID 1140 wrote to memory of 3648 1140 4DF1.tmp 96 PID 3648 wrote to memory of 3764 3648 4E5E.tmp 97 PID 3648 wrote to memory of 3764 3648 4E5E.tmp 97 PID 3648 wrote to memory of 3764 3648 4E5E.tmp 97 PID 3764 wrote to memory of 2020 3764 4EAC.tmp 98 PID 3764 wrote to memory of 2020 3764 4EAC.tmp 98 PID 3764 wrote to memory of 2020 3764 4EAC.tmp 98 PID 2020 wrote to memory of 2928 2020 4EFB.tmp 99 PID 2020 wrote to memory of 2928 2020 4EFB.tmp 99 PID 2020 wrote to memory of 2928 2020 4EFB.tmp 99 PID 2928 wrote to memory of 2600 2928 4F58.tmp 100 PID 2928 wrote to memory of 2600 2928 4F58.tmp 100 PID 2928 wrote to memory of 2600 2928 4F58.tmp 100 PID 2600 wrote to memory of 4812 2600 4FC6.tmp 101 PID 2600 wrote to memory of 4812 2600 4FC6.tmp 101 PID 2600 wrote to memory of 4812 2600 4FC6.tmp 101 PID 4812 wrote to memory of 1476 4812 5014.tmp 102 PID 4812 wrote to memory of 1476 4812 5014.tmp 102 PID 4812 wrote to memory of 1476 4812 5014.tmp 102 PID 1476 wrote to memory of 2240 1476 5072.tmp 103 PID 1476 wrote to memory of 2240 1476 5072.tmp 103 PID 1476 wrote to memory of 2240 1476 5072.tmp 103 PID 2240 wrote to memory of 3508 2240 50DF.tmp 104 PID 2240 wrote to memory of 3508 2240 50DF.tmp 104 PID 2240 wrote to memory of 3508 2240 50DF.tmp 104 PID 3508 wrote to memory of 4388 3508 514C.tmp 105 PID 3508 wrote to memory of 4388 3508 514C.tmp 105 PID 3508 wrote to memory of 4388 3508 514C.tmp 105 PID 4388 wrote to memory of 2440 4388 51BA.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ca74206ded105ad061bd42ef07724e46_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"23⤵
- Executes dropped EXE
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"24⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"25⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"26⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"27⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"28⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"29⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"30⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"31⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"32⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"33⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"34⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"35⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"36⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"37⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"38⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"39⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"40⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"41⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"42⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"43⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"44⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"45⤵
- Executes dropped EXE
PID:2296 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"46⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"47⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"48⤵
- Executes dropped EXE
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"49⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"50⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"51⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"52⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"53⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"54⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"55⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"56⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"57⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"58⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"59⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"60⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"61⤵
- Executes dropped EXE
PID:2176 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"62⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"63⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"64⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"65⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"66⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"67⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"68⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"69⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"70⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"71⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"72⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"73⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"74⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"75⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"76⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"77⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"78⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"79⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"80⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"81⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"82⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"83⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"84⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"85⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"86⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"87⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"88⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"89⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"90⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"91⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"92⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"93⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"94⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"95⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"96⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"97⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"98⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"99⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"100⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"101⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"102⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"103⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"104⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"105⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"106⤵PID:4212
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"107⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"108⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"109⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"110⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"111⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6F15.tmp"C:\Users\Admin\AppData\Local\Temp\6F15.tmp"112⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6F63.tmp"C:\Users\Admin\AppData\Local\Temp\6F63.tmp"113⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"C:\Users\Admin\AppData\Local\Temp\6FB2.tmp"114⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"115⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"116⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"117⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"118⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"119⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"120⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"121⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"122⤵PID:1216
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-