Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 04:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
Resource
win7-20240220-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
Resource
win10v2004-20240412-en
2 signatures
150 seconds
General
-
Target
2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe
-
Size
520KB
-
MD5
54a245d35e26e1a920ab243e739692db
-
SHA1
b63afcdb76517e61a524594efe17afbdb0fb82f0
-
SHA256
be3b1890e4943e27e7230152cf84a1934313a14b96252aa786f9155b0b67ef22
-
SHA512
fbd6b1a5cc0b0750cd00e35488152cd7cec3e2ff30069e33f7755b46a7260d784e86a9b5fda027ebed388df58e13afe4f3a52618d4c6725d2757d23311531701
-
SSDEEP
12288:gj8fuxR21t5i8ffcUDqCucxW3UgEm6NZ:gj8fuK1GYEUD9u6aUgEm6N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1616 3CDA.tmp 828 3D38.tmp 4620 3D86.tmp 1244 3DF3.tmp 4692 3E70.tmp 1520 3EDE.tmp 5068 3F2C.tmp 2528 3F7A.tmp 4236 3FC8.tmp 5004 4016.tmp 2584 4083.tmp 3356 40D2.tmp 1008 412F.tmp 4872 418D.tmp 1956 41DB.tmp 4928 4239.tmp 2332 4297.tmp 3192 42E5.tmp 4464 4352.tmp 3464 43A0.tmp 2772 43EE.tmp 4956 442D.tmp 1176 449A.tmp 1960 44F8.tmp 948 4556.tmp 1460 45B4.tmp 1280 4611.tmp 5000 465F.tmp 116 46AE.tmp 2520 471B.tmp 3988 4788.tmp 1912 47E6.tmp 4112 4834.tmp 4696 4882.tmp 1880 48E0.tmp 1288 493E.tmp 3948 498C.tmp 3712 49DA.tmp 2528 4A28.tmp 1508 4A86.tmp 944 4AD4.tmp 2584 4B22.tmp 3356 4B80.tmp 4840 4BDE.tmp 3324 4C3B.tmp 3620 4C99.tmp 3544 4CF7.tmp 4404 4D45.tmp 5108 4D93.tmp 1036 4DE1.tmp 2768 4E2F.tmp 1176 4E7E.tmp 4916 4EDB.tmp 4524 4F39.tmp 4336 4F97.tmp 324 4FF5.tmp 804 5052.tmp 3444 50B0.tmp 1436 510E.tmp 4348 516C.tmp 4384 51C9.tmp 4300 5217.tmp 828 5275.tmp 1128 52E3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2800 wrote to memory of 1616 2800 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 87 PID 2800 wrote to memory of 1616 2800 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 87 PID 2800 wrote to memory of 1616 2800 2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe 87 PID 1616 wrote to memory of 828 1616 3CDA.tmp 88 PID 1616 wrote to memory of 828 1616 3CDA.tmp 88 PID 1616 wrote to memory of 828 1616 3CDA.tmp 88 PID 828 wrote to memory of 4620 828 3D38.tmp 89 PID 828 wrote to memory of 4620 828 3D38.tmp 89 PID 828 wrote to memory of 4620 828 3D38.tmp 89 PID 4620 wrote to memory of 1244 4620 3D86.tmp 90 PID 4620 wrote to memory of 1244 4620 3D86.tmp 90 PID 4620 wrote to memory of 1244 4620 3D86.tmp 90 PID 1244 wrote to memory of 4692 1244 3DF3.tmp 92 PID 1244 wrote to memory of 4692 1244 3DF3.tmp 92 PID 1244 wrote to memory of 4692 1244 3DF3.tmp 92 PID 4692 wrote to memory of 1520 4692 3E70.tmp 93 PID 4692 wrote to memory of 1520 4692 3E70.tmp 93 PID 4692 wrote to memory of 1520 4692 3E70.tmp 93 PID 1520 wrote to memory of 5068 1520 3EDE.tmp 94 PID 1520 wrote to memory of 5068 1520 3EDE.tmp 94 PID 1520 wrote to memory of 5068 1520 3EDE.tmp 94 PID 5068 wrote to memory of 2528 5068 3F2C.tmp 95 PID 5068 wrote to memory of 2528 5068 3F2C.tmp 95 PID 5068 wrote to memory of 2528 5068 3F2C.tmp 95 PID 2528 wrote to memory of 4236 2528 3F7A.tmp 96 PID 2528 wrote to memory of 4236 2528 3F7A.tmp 96 PID 2528 wrote to memory of 4236 2528 3F7A.tmp 96 PID 4236 wrote to memory of 5004 4236 3FC8.tmp 97 PID 4236 wrote to memory of 5004 4236 3FC8.tmp 97 PID 4236 wrote to memory of 5004 4236 3FC8.tmp 97 PID 5004 wrote to memory of 2584 5004 4016.tmp 98 PID 5004 wrote to memory of 2584 5004 4016.tmp 98 PID 5004 wrote to memory of 2584 5004 4016.tmp 98 PID 2584 wrote to memory of 3356 2584 4083.tmp 100 PID 2584 wrote to memory of 3356 2584 4083.tmp 100 PID 2584 wrote to memory of 3356 2584 4083.tmp 100 PID 3356 wrote to memory of 1008 3356 40D2.tmp 101 PID 3356 wrote to memory of 1008 3356 40D2.tmp 101 PID 3356 wrote to memory of 1008 3356 40D2.tmp 101 PID 1008 wrote to memory of 4872 1008 412F.tmp 102 PID 1008 wrote to memory of 4872 1008 412F.tmp 102 PID 1008 wrote to memory of 4872 1008 412F.tmp 102 PID 4872 wrote to memory of 1956 4872 418D.tmp 103 PID 4872 wrote to memory of 1956 4872 418D.tmp 103 PID 4872 wrote to memory of 1956 4872 418D.tmp 103 PID 1956 wrote to memory of 4928 1956 41DB.tmp 104 PID 1956 wrote to memory of 4928 1956 41DB.tmp 104 PID 1956 wrote to memory of 4928 1956 41DB.tmp 104 PID 4928 wrote to memory of 2332 4928 4239.tmp 105 PID 4928 wrote to memory of 2332 4928 4239.tmp 105 PID 4928 wrote to memory of 2332 4928 4239.tmp 105 PID 2332 wrote to memory of 3192 2332 4297.tmp 106 PID 2332 wrote to memory of 3192 2332 4297.tmp 106 PID 2332 wrote to memory of 3192 2332 4297.tmp 106 PID 3192 wrote to memory of 4464 3192 42E5.tmp 107 PID 3192 wrote to memory of 4464 3192 42E5.tmp 107 PID 3192 wrote to memory of 4464 3192 42E5.tmp 107 PID 4464 wrote to memory of 3464 4464 4352.tmp 108 PID 4464 wrote to memory of 3464 4464 4352.tmp 108 PID 4464 wrote to memory of 3464 4464 4352.tmp 108 PID 3464 wrote to memory of 2772 3464 43A0.tmp 109 PID 3464 wrote to memory of 2772 3464 43A0.tmp 109 PID 3464 wrote to memory of 2772 3464 43A0.tmp 109 PID 2772 wrote to memory of 4956 2772 43EE.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_54a245d35e26e1a920ab243e739692db_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\3D86.tmp"C:\Users\Admin\AppData\Local\Temp\3D86.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"C:\Users\Admin\AppData\Local\Temp\3DF3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"C:\Users\Admin\AppData\Local\Temp\3EDE.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"C:\Users\Admin\AppData\Local\Temp\3F2C.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\418D.tmp"C:\Users\Admin\AppData\Local\Temp\418D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"23⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"24⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"25⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"26⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"27⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"28⤵
- Executes dropped EXE
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"29⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"30⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"31⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"32⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"33⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"34⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"35⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"36⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"37⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"38⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"39⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"40⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"41⤵
- Executes dropped EXE
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"42⤵
- Executes dropped EXE
PID:944 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"43⤵
- Executes dropped EXE
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"44⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"45⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"46⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"47⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"48⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\4D45.tmp"C:\Users\Admin\AppData\Local\Temp\4D45.tmp"49⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"50⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"51⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"52⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"53⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"54⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\4F39.tmp"C:\Users\Admin\AppData\Local\Temp\4F39.tmp"55⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"56⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"57⤵
- Executes dropped EXE
PID:324 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"58⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"59⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"60⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"61⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"62⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"63⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"64⤵
- Executes dropped EXE
PID:828 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"65⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"66⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"67⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"68⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"69⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\54A8.tmp"C:\Users\Admin\AppData\Local\Temp\54A8.tmp"70⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"71⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"72⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"73⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"74⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"75⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"76⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"77⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"78⤵PID:4180
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"79⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"80⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"81⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"82⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"83⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"84⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"85⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"86⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"87⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"88⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"89⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"90⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"91⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"92⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"93⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"94⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"95⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"96⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"97⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"98⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"99⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"100⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"101⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"102⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"103⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"104⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"105⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"106⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"107⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"108⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"109⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"110⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"111⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"112⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"113⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"114⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"115⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"116⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"117⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"118⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"119⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"120⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"121⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"122⤵PID:1412
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-