Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 10:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe
-
Size
765KB
-
MD5
e62ddf02f1827459a22b6410305abc0c
-
SHA1
2d5ae3503b626b38959bc8da96ae07a0a64fa7c7
-
SHA256
ce098f8c7cb3373a27b84952afd0d2e351e478f8ec82fe14c100efaae281b356
-
SHA512
7a40d685000f5fd0e2b2157247f04a95b754606760cdadd5f8b150ba170521cedb624d1960802125b607c3d5013453f7e6c86bf2e218c4dff7e0341c7e7f09d0
-
SSDEEP
12288:ZU5rCOTeiDe9E7l0YyTdCg6Vg0JGcL03ZF5rn5rLOa54U5w5A:ZUQOJDe9ER0DpR6Vjwcw3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3536 343F.tmp 4744 34AC.tmp 4596 350A.tmp 3124 3597.tmp 828 35E5.tmp 4100 3633.tmp 2928 3681.tmp 584 36EE.tmp 1828 374C.tmp 4548 37C9.tmp 4728 3827.tmp 4964 3875.tmp 3084 38C3.tmp 4260 3911.tmp 3136 395F.tmp 1224 39EC.tmp 2376 3A4A.tmp 756 3A98.tmp 1924 3AE6.tmp 5092 3B53.tmp 2900 3C0F.tmp 2200 3C7C.tmp 3856 3CCA.tmp 1236 3D18.tmp 4012 3D67.tmp 1036 3DD4.tmp 3132 3E22.tmp 4844 3E70.tmp 4800 3EED.tmp 4568 3F5B.tmp 4340 3FC8.tmp 3440 4016.tmp 1736 4064.tmp 1512 40B2.tmp 3936 4110.tmp 1368 417D.tmp 228 41CC.tmp 60 421A.tmp 828 4268.tmp 3928 42B6.tmp 4320 4304.tmp 1332 4352.tmp 1180 43A0.tmp 4900 43FE.tmp 4696 444C.tmp 2276 449A.tmp 4556 44E8.tmp 1652 4537.tmp 4544 4585.tmp 4828 45E2.tmp 1208 4631.tmp 4964 467F.tmp 1292 46CD.tmp 2940 471B.tmp 388 4769.tmp 4816 47B7.tmp 3904 4805.tmp 3860 4853.tmp 4976 48A2.tmp 2952 48F0.tmp 1924 493E.tmp 3616 49BB.tmp 3328 4A38.tmp 792 4AD4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1320 wrote to memory of 3536 1320 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 87 PID 1320 wrote to memory of 3536 1320 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 87 PID 1320 wrote to memory of 3536 1320 2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe 87 PID 3536 wrote to memory of 4744 3536 343F.tmp 88 PID 3536 wrote to memory of 4744 3536 343F.tmp 88 PID 3536 wrote to memory of 4744 3536 343F.tmp 88 PID 4744 wrote to memory of 4596 4744 34AC.tmp 89 PID 4744 wrote to memory of 4596 4744 34AC.tmp 89 PID 4744 wrote to memory of 4596 4744 34AC.tmp 89 PID 4596 wrote to memory of 3124 4596 350A.tmp 90 PID 4596 wrote to memory of 3124 4596 350A.tmp 90 PID 4596 wrote to memory of 3124 4596 350A.tmp 90 PID 3124 wrote to memory of 828 3124 3597.tmp 129 PID 3124 wrote to memory of 828 3124 3597.tmp 129 PID 3124 wrote to memory of 828 3124 3597.tmp 129 PID 828 wrote to memory of 4100 828 35E5.tmp 94 PID 828 wrote to memory of 4100 828 35E5.tmp 94 PID 828 wrote to memory of 4100 828 35E5.tmp 94 PID 4100 wrote to memory of 2928 4100 3633.tmp 95 PID 4100 wrote to memory of 2928 4100 3633.tmp 95 PID 4100 wrote to memory of 2928 4100 3633.tmp 95 PID 2928 wrote to memory of 584 2928 3681.tmp 97 PID 2928 wrote to memory of 584 2928 3681.tmp 97 PID 2928 wrote to memory of 584 2928 3681.tmp 97 PID 584 wrote to memory of 1828 584 36EE.tmp 98 PID 584 wrote to memory of 1828 584 36EE.tmp 98 PID 584 wrote to memory of 1828 584 36EE.tmp 98 PID 1828 wrote to memory of 4548 1828 374C.tmp 99 PID 1828 wrote to memory of 4548 1828 374C.tmp 99 PID 1828 wrote to memory of 4548 1828 374C.tmp 99 PID 4548 wrote to memory of 4728 4548 37C9.tmp 100 PID 4548 wrote to memory of 4728 4548 37C9.tmp 100 PID 4548 wrote to memory of 4728 4548 37C9.tmp 100 PID 4728 wrote to memory of 4964 4728 3827.tmp 142 PID 4728 wrote to memory of 4964 4728 3827.tmp 142 PID 4728 wrote to memory of 4964 4728 3827.tmp 142 PID 4964 wrote to memory of 3084 4964 3875.tmp 102 PID 4964 wrote to memory of 3084 4964 3875.tmp 102 PID 4964 wrote to memory of 3084 4964 3875.tmp 102 PID 3084 wrote to memory of 4260 3084 38C3.tmp 103 PID 3084 wrote to memory of 4260 3084 38C3.tmp 103 PID 3084 wrote to memory of 4260 3084 38C3.tmp 103 PID 4260 wrote to memory of 3136 4260 3911.tmp 104 PID 4260 wrote to memory of 3136 4260 3911.tmp 104 PID 4260 wrote to memory of 3136 4260 3911.tmp 104 PID 3136 wrote to memory of 1224 3136 395F.tmp 105 PID 3136 wrote to memory of 1224 3136 395F.tmp 105 PID 3136 wrote to memory of 1224 3136 395F.tmp 105 PID 1224 wrote to memory of 2376 1224 39EC.tmp 106 PID 1224 wrote to memory of 2376 1224 39EC.tmp 106 PID 1224 wrote to memory of 2376 1224 39EC.tmp 106 PID 2376 wrote to memory of 756 2376 3A4A.tmp 107 PID 2376 wrote to memory of 756 2376 3A4A.tmp 107 PID 2376 wrote to memory of 756 2376 3A4A.tmp 107 PID 756 wrote to memory of 1924 756 3A98.tmp 151 PID 756 wrote to memory of 1924 756 3A98.tmp 151 PID 756 wrote to memory of 1924 756 3A98.tmp 151 PID 1924 wrote to memory of 5092 1924 3AE6.tmp 110 PID 1924 wrote to memory of 5092 1924 3AE6.tmp 110 PID 1924 wrote to memory of 5092 1924 3AE6.tmp 110 PID 5092 wrote to memory of 2900 5092 3B53.tmp 111 PID 5092 wrote to memory of 2900 5092 3B53.tmp 111 PID 5092 wrote to memory of 2900 5092 3B53.tmp 111 PID 2900 wrote to memory of 2200 2900 3C0F.tmp 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e62ddf02f1827459a22b6410305abc0c_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\343F.tmp"C:\Users\Admin\AppData\Local\Temp\343F.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\34AC.tmp"C:\Users\Admin\AppData\Local\Temp\34AC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\3597.tmp"C:\Users\Admin\AppData\Local\Temp\3597.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Users\Admin\AppData\Local\Temp\35E5.tmp"C:\Users\Admin\AppData\Local\Temp\35E5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3633.tmp"C:\Users\Admin\AppData\Local\Temp\3633.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\3681.tmp"C:\Users\Admin\AppData\Local\Temp\3681.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\36EE.tmp"C:\Users\Admin\AppData\Local\Temp\36EE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Users\Admin\AppData\Local\Temp\374C.tmp"C:\Users\Admin\AppData\Local\Temp\374C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\3827.tmp"C:\Users\Admin\AppData\Local\Temp\3827.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\395F.tmp"C:\Users\Admin\AppData\Local\Temp\395F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"C:\Users\Admin\AppData\Local\Temp\3A4A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"C:\Users\Admin\AppData\Local\Temp\3AE6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"C:\Users\Admin\AppData\Local\Temp\3C0F.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"23⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"C:\Users\Admin\AppData\Local\Temp\3CCA.tmp"24⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\3D18.tmp"C:\Users\Admin\AppData\Local\Temp\3D18.tmp"25⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"26⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"27⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"28⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"29⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"30⤵
- Executes dropped EXE
PID:4800 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"31⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"32⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"33⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"34⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"35⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"36⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"37⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"38⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"39⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"40⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"41⤵
- Executes dropped EXE
PID:3928 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"42⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"43⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"44⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"45⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"46⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"47⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"48⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"49⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"50⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"51⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"52⤵
- Executes dropped EXE
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"53⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"54⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"55⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"56⤵
- Executes dropped EXE
PID:388 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"57⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"58⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"59⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"60⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"61⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"62⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"63⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"64⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"65⤵
- Executes dropped EXE
PID:792 -
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"66⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"67⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"68⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"69⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"70⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"71⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"73⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"74⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"75⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"76⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"77⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"78⤵PID:3432
-
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"79⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"80⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"81⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"82⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"83⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"84⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"85⤵PID:2424
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"86⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"87⤵PID:4540
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"88⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"89⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"90⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"91⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"92⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"93⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"94⤵PID:4964
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"95⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"96⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"97⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"98⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"99⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"100⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"101⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"102⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\5861.tmp"C:\Users\Admin\AppData\Local\Temp\5861.tmp"103⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"104⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"105⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"106⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"107⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"108⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"109⤵PID:5036
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"110⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"111⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"112⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"113⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"114⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"115⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"116⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"117⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"118⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"119⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"120⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"121⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"122⤵PID:4708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-