Analysis
-
max time kernel
150s -
max time network
141s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 15:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe
-
Size
530KB
-
MD5
c91690d00774a8f5b6689511661a451b
-
SHA1
229f4ff7e0c1f48b844f170d2589055e5454ce7b
-
SHA256
46bb9cd05ae80855337ae7dd00459e2b2a046ba80580609daced13f081a9774a
-
SHA512
51a081909cf94e0ebdfcabe6e4338dc14884b04e84bb9b9fa45c4e7c2b2c78d4806c6f9a48a092d7cceff841966a8e6765b60af8111309b509e4e5325aa63121
-
SSDEEP
12288:AU5rCOTeioL0+lSoxyWpqkUG/rrudNZulFVg0M1:AUQOJoL0+lSHWpqkUir6dNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5048 3E41.tmp 4292 3EBE.tmp 4664 3F1C.tmp 2884 3F89.tmp 4156 4006.tmp 2468 4074.tmp 4584 40D2.tmp 1260 4120.tmp 1340 419D.tmp 1920 41FA.tmp 1932 4277.tmp 1384 42D5.tmp 3348 4333.tmp 2456 4381.tmp 1552 43EE.tmp 3388 445C.tmp 3392 44BA.tmp 4832 44F8.tmp 1988 4546.tmp 1556 4594.tmp 1968 45E2.tmp 2016 4650.tmp 1428 469E.tmp 3240 46FC.tmp 3968 4759.tmp 1048 47B7.tmp 536 4815.tmp 3128 4863.tmp 3140 48C1.tmp 2852 490F.tmp 3424 495D.tmp 3884 49AB.tmp 2832 49F9.tmp 3104 4A47.tmp 3844 4A86.tmp 1608 4AC4.tmp 220 4B41.tmp 4528 4B9F.tmp 4824 4BFD.tmp 3460 4C4B.tmp 5028 4CC8.tmp 4584 4D26.tmp 2436 4D84.tmp 1876 4DD2.tmp 2636 4E20.tmp 892 4E6E.tmp 1932 4ECC.tmp 436 4F29.tmp 4932 4F87.tmp 960 4FE5.tmp 4100 5033.tmp 944 5081.tmp 3328 50CF.tmp 1968 512D.tmp 2948 518B.tmp 1688 51D9.tmp 4600 5237.tmp 2168 5285.tmp 4928 52E3.tmp 3232 5331.tmp 3236 538E.tmp 3968 53DD.tmp 1048 542B.tmp 1508 5488.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2812 wrote to memory of 5048 2812 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 89 PID 2812 wrote to memory of 5048 2812 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 89 PID 2812 wrote to memory of 5048 2812 2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe 89 PID 5048 wrote to memory of 4292 5048 3E41.tmp 90 PID 5048 wrote to memory of 4292 5048 3E41.tmp 90 PID 5048 wrote to memory of 4292 5048 3E41.tmp 90 PID 4292 wrote to memory of 4664 4292 3EBE.tmp 91 PID 4292 wrote to memory of 4664 4292 3EBE.tmp 91 PID 4292 wrote to memory of 4664 4292 3EBE.tmp 91 PID 4664 wrote to memory of 2884 4664 3F1C.tmp 92 PID 4664 wrote to memory of 2884 4664 3F1C.tmp 92 PID 4664 wrote to memory of 2884 4664 3F1C.tmp 92 PID 2884 wrote to memory of 4156 2884 3F89.tmp 94 PID 2884 wrote to memory of 4156 2884 3F89.tmp 94 PID 2884 wrote to memory of 4156 2884 3F89.tmp 94 PID 4156 wrote to memory of 2468 4156 4006.tmp 97 PID 4156 wrote to memory of 2468 4156 4006.tmp 97 PID 4156 wrote to memory of 2468 4156 4006.tmp 97 PID 2468 wrote to memory of 4584 2468 4074.tmp 98 PID 2468 wrote to memory of 4584 2468 4074.tmp 98 PID 2468 wrote to memory of 4584 2468 4074.tmp 98 PID 4584 wrote to memory of 1260 4584 40D2.tmp 99 PID 4584 wrote to memory of 1260 4584 40D2.tmp 99 PID 4584 wrote to memory of 1260 4584 40D2.tmp 99 PID 1260 wrote to memory of 1340 1260 4120.tmp 100 PID 1260 wrote to memory of 1340 1260 4120.tmp 100 PID 1260 wrote to memory of 1340 1260 4120.tmp 100 PID 1340 wrote to memory of 1920 1340 419D.tmp 101 PID 1340 wrote to memory of 1920 1340 419D.tmp 101 PID 1340 wrote to memory of 1920 1340 419D.tmp 101 PID 1920 wrote to memory of 1932 1920 41FA.tmp 102 PID 1920 wrote to memory of 1932 1920 41FA.tmp 102 PID 1920 wrote to memory of 1932 1920 41FA.tmp 102 PID 1932 wrote to memory of 1384 1932 4277.tmp 103 PID 1932 wrote to memory of 1384 1932 4277.tmp 103 PID 1932 wrote to memory of 1384 1932 4277.tmp 103 PID 1384 wrote to memory of 3348 1384 42D5.tmp 104 PID 1384 wrote to memory of 3348 1384 42D5.tmp 104 PID 1384 wrote to memory of 3348 1384 42D5.tmp 104 PID 3348 wrote to memory of 2456 3348 4333.tmp 105 PID 3348 wrote to memory of 2456 3348 4333.tmp 105 PID 3348 wrote to memory of 2456 3348 4333.tmp 105 PID 2456 wrote to memory of 1552 2456 4381.tmp 106 PID 2456 wrote to memory of 1552 2456 4381.tmp 106 PID 2456 wrote to memory of 1552 2456 4381.tmp 106 PID 1552 wrote to memory of 3388 1552 43EE.tmp 107 PID 1552 wrote to memory of 3388 1552 43EE.tmp 107 PID 1552 wrote to memory of 3388 1552 43EE.tmp 107 PID 3388 wrote to memory of 3392 3388 445C.tmp 108 PID 3388 wrote to memory of 3392 3388 445C.tmp 108 PID 3388 wrote to memory of 3392 3388 445C.tmp 108 PID 3392 wrote to memory of 4832 3392 44BA.tmp 109 PID 3392 wrote to memory of 4832 3392 44BA.tmp 109 PID 3392 wrote to memory of 4832 3392 44BA.tmp 109 PID 4832 wrote to memory of 1988 4832 44F8.tmp 110 PID 4832 wrote to memory of 1988 4832 44F8.tmp 110 PID 4832 wrote to memory of 1988 4832 44F8.tmp 110 PID 1988 wrote to memory of 1556 1988 4546.tmp 111 PID 1988 wrote to memory of 1556 1988 4546.tmp 111 PID 1988 wrote to memory of 1556 1988 4546.tmp 111 PID 1556 wrote to memory of 1968 1556 4594.tmp 112 PID 1556 wrote to memory of 1968 1556 4594.tmp 112 PID 1556 wrote to memory of 1968 1556 4594.tmp 112 PID 1968 wrote to memory of 2016 1968 45E2.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_c91690d00774a8f5b6689511661a451b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\445C.tmp"C:\Users\Admin\AppData\Local\Temp\445C.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"23⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"24⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"25⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"26⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"27⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"28⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"29⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"30⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"31⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"32⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"33⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"34⤵
- Executes dropped EXE
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"35⤵
- Executes dropped EXE
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"36⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"37⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"38⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"39⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"40⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"41⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"42⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"43⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"44⤵
- Executes dropped EXE
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"C:\Users\Admin\AppData\Local\Temp\4DD2.tmp"45⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"46⤵
- Executes dropped EXE
PID:2636 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"47⤵
- Executes dropped EXE
PID:892 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"48⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"49⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"50⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"51⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"52⤵
- Executes dropped EXE
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"53⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\50CF.tmp"C:\Users\Admin\AppData\Local\Temp\50CF.tmp"54⤵
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"55⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"56⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"57⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"58⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"59⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"60⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"61⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"62⤵
- Executes dropped EXE
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"63⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"64⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"65⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"66⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"67⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"68⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"69⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"70⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"71⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"72⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"73⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"74⤵PID:2368
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"75⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"76⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"77⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"78⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"79⤵PID:4824
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"80⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"81⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"82⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"83⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"84⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"85⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"86⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"87⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"88⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"89⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"90⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"91⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"92⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"93⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"94⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"95⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"96⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"97⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"98⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"99⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"100⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"101⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"102⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"103⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"104⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"105⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"106⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\62F0.tmp"C:\Users\Admin\AppData\Local\Temp\62F0.tmp"107⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"108⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"109⤵PID:2684
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"110⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"111⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"112⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"113⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"114⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"115⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"116⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"117⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"118⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"119⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"120⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"121⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-