Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 12:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe
-
Size
520KB
-
MD5
51723c5d8fcff1bdd0fb958d3db082c1
-
SHA1
14f611659ae7fc46aacc3c32ba9fc4e90836e1da
-
SHA256
248f454605f198978beaf8a4c498b19a8c904257e24744dc78c05bc5899b8816
-
SHA512
b3a0b8d7d4d41f79f62d886f56581b692a23bc2b95c958641488b1ad38128cd78cea3487e4b4d1d76bab87597190c9130a3cd093f55f251d38aee70554852094
-
SSDEEP
12288:gj8fuxR21t5i8ffLISrez1X9hSqbdPgK36uusNZ:gj8fuK1GYskKdLSqJDXN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3564 38A4.tmp 1184 3921.tmp 464 398E.tmp 1384 39FC.tmp 4408 3A69.tmp 3420 3AC7.tmp 2352 3B44.tmp 3508 3B92.tmp 4344 3BE0.tmp 1832 3C2E.tmp 452 3C8C.tmp 868 3CDA.tmp 4424 3D38.tmp 1128 3D95.tmp 408 3DE4.tmp 4760 3E32.tmp 2524 3E80.tmp 2240 3EED.tmp 1140 3F3B.tmp 2316 3FA9.tmp 5060 3FF7.tmp 4508 4064.tmp 3676 40D2.tmp 1212 414F.tmp 1476 41AC.tmp 2020 420A.tmp 1900 4258.tmp 5012 42A6.tmp 336 4314.tmp 3104 4381.tmp 2828 43DF.tmp 1480 442D.tmp 3992 44D9.tmp 1848 4537.tmp 4696 4594.tmp 1184 45E2.tmp 2644 4631.tmp 1040 467F.tmp 4552 46DC.tmp 1316 474A.tmp 4664 4798.tmp 4408 47E6.tmp 2676 4834.tmp 2308 4882.tmp 208 48D0.tmp 2420 492E.tmp 3508 498C.tmp 1404 49EA.tmp 4992 4A38.tmp 3116 4A86.tmp 2512 4AD4.tmp 4960 4B22.tmp 1200 4B70.tmp 4100 4BCE.tmp 2268 4C1C.tmp 1952 4C6A.tmp 1920 4CB8.tmp 2448 4D07.tmp 2976 4D55.tmp 1980 4DB2.tmp 2240 4E01.tmp 2008 4E4F.tmp 2316 4E9D.tmp 4752 4EEB.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3296 wrote to memory of 3564 3296 2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe 88 PID 3296 wrote to memory of 3564 3296 2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe 88 PID 3296 wrote to memory of 3564 3296 2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe 88 PID 3564 wrote to memory of 1184 3564 38A4.tmp 89 PID 3564 wrote to memory of 1184 3564 38A4.tmp 89 PID 3564 wrote to memory of 1184 3564 38A4.tmp 89 PID 1184 wrote to memory of 464 1184 3921.tmp 90 PID 1184 wrote to memory of 464 1184 3921.tmp 90 PID 1184 wrote to memory of 464 1184 3921.tmp 90 PID 464 wrote to memory of 1384 464 398E.tmp 93 PID 464 wrote to memory of 1384 464 398E.tmp 93 PID 464 wrote to memory of 1384 464 398E.tmp 93 PID 1384 wrote to memory of 4408 1384 39FC.tmp 95 PID 1384 wrote to memory of 4408 1384 39FC.tmp 95 PID 1384 wrote to memory of 4408 1384 39FC.tmp 95 PID 4408 wrote to memory of 3420 4408 3A69.tmp 96 PID 4408 wrote to memory of 3420 4408 3A69.tmp 96 PID 4408 wrote to memory of 3420 4408 3A69.tmp 96 PID 3420 wrote to memory of 2352 3420 3AC7.tmp 97 PID 3420 wrote to memory of 2352 3420 3AC7.tmp 97 PID 3420 wrote to memory of 2352 3420 3AC7.tmp 97 PID 2352 wrote to memory of 3508 2352 3B44.tmp 98 PID 2352 wrote to memory of 3508 2352 3B44.tmp 98 PID 2352 wrote to memory of 3508 2352 3B44.tmp 98 PID 3508 wrote to memory of 4344 3508 3B92.tmp 99 PID 3508 wrote to memory of 4344 3508 3B92.tmp 99 PID 3508 wrote to memory of 4344 3508 3B92.tmp 99 PID 4344 wrote to memory of 1832 4344 3BE0.tmp 100 PID 4344 wrote to memory of 1832 4344 3BE0.tmp 100 PID 4344 wrote to memory of 1832 4344 3BE0.tmp 100 PID 1832 wrote to memory of 452 1832 3C2E.tmp 101 PID 1832 wrote to memory of 452 1832 3C2E.tmp 101 PID 1832 wrote to memory of 452 1832 3C2E.tmp 101 PID 452 wrote to memory of 868 452 3C8C.tmp 102 PID 452 wrote to memory of 868 452 3C8C.tmp 102 PID 452 wrote to memory of 868 452 3C8C.tmp 102 PID 868 wrote to memory of 4424 868 3CDA.tmp 103 PID 868 wrote to memory of 4424 868 3CDA.tmp 103 PID 868 wrote to memory of 4424 868 3CDA.tmp 103 PID 4424 wrote to memory of 1128 4424 3D38.tmp 104 PID 4424 wrote to memory of 1128 4424 3D38.tmp 104 PID 4424 wrote to memory of 1128 4424 3D38.tmp 104 PID 1128 wrote to memory of 408 1128 3D95.tmp 105 PID 1128 wrote to memory of 408 1128 3D95.tmp 105 PID 1128 wrote to memory of 408 1128 3D95.tmp 105 PID 408 wrote to memory of 4760 408 3DE4.tmp 106 PID 408 wrote to memory of 4760 408 3DE4.tmp 106 PID 408 wrote to memory of 4760 408 3DE4.tmp 106 PID 4760 wrote to memory of 2524 4760 3E32.tmp 107 PID 4760 wrote to memory of 2524 4760 3E32.tmp 107 PID 4760 wrote to memory of 2524 4760 3E32.tmp 107 PID 2524 wrote to memory of 2240 2524 3E80.tmp 108 PID 2524 wrote to memory of 2240 2524 3E80.tmp 108 PID 2524 wrote to memory of 2240 2524 3E80.tmp 108 PID 2240 wrote to memory of 1140 2240 3EED.tmp 109 PID 2240 wrote to memory of 1140 2240 3EED.tmp 109 PID 2240 wrote to memory of 1140 2240 3EED.tmp 109 PID 1140 wrote to memory of 2316 1140 3F3B.tmp 110 PID 1140 wrote to memory of 2316 1140 3F3B.tmp 110 PID 1140 wrote to memory of 2316 1140 3F3B.tmp 110 PID 2316 wrote to memory of 5060 2316 3FA9.tmp 111 PID 2316 wrote to memory of 5060 2316 3FA9.tmp 111 PID 2316 wrote to memory of 5060 2316 3FA9.tmp 111 PID 5060 wrote to memory of 4508 5060 3FF7.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-07_51723c5d8fcff1bdd0fb958d3db082c1_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\3921.tmp"C:\Users\Admin\AppData\Local\Temp\3921.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\39FC.tmp"C:\Users\Admin\AppData\Local\Temp\39FC.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"C:\Users\Admin\AppData\Local\Temp\3C8C.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"23⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"24⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"25⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\41AC.tmp"C:\Users\Admin\AppData\Local\Temp\41AC.tmp"26⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"27⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"28⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\42A6.tmp"C:\Users\Admin\AppData\Local\Temp\42A6.tmp"29⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"30⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"31⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"32⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"33⤵
- Executes dropped EXE
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"34⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"35⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"36⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"37⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"38⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"39⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"40⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"41⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"42⤵
- Executes dropped EXE
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"43⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"44⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"45⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"46⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"47⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"48⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"49⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"50⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"51⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"52⤵
- Executes dropped EXE
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"53⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"54⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"55⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"56⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"57⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"58⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"59⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"60⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"61⤵
- Executes dropped EXE
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"62⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"63⤵
- Executes dropped EXE
PID:2240 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"64⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"65⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"66⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"67⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"68⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"69⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"70⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"71⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"72⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"73⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"74⤵PID:4720
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"75⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"76⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"77⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"78⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"79⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"80⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"81⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"82⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"83⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"84⤵PID:1760
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"85⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"86⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"87⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"88⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"89⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"90⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"91⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"92⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"93⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"94⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"95⤵PID:1724
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"96⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"97⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"98⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"99⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"100⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"101⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"102⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"103⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"104⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"105⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"106⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"107⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"108⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"109⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"110⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"111⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"112⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"113⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"114⤵PID:3964
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"115⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"116⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"117⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"118⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"119⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"120⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"121⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"122⤵PID:320
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-