Analysis
-
max time kernel
150s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 03:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe
Resource
win10v2004-20240419-en
2 signatures
150 seconds
General
-
Target
2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe
-
Size
527KB
-
MD5
8f4473212c08542a9e34c778ffed9f53
-
SHA1
91e150934f3cba50797cca88895c4735443968dd
-
SHA256
596138ee4cefdff03ee66b2bdbfd007b635355664904d6685a5e5528ada0ebc8
-
SHA512
734bc1aa7b060c75865f0cd40ff4f9b3676e459e8eaca9f71dcf8bc57edb46459398d920e9b42a52e53007f3780e242e1d6fa75ae86639b23ed267bacbf0ec44
-
SSDEEP
12288:fU5rCOTeidEmQ+kkSL95+3roi8X5vwsBeS+vDZu:fUQOJdEYkvLbigIsELvDo
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4452 32E7.tmp 1140 3383.tmp 1376 33F1.tmp 212 348D.tmp 3720 350A.tmp 3168 3587.tmp 2832 3623.tmp 2112 36B0.tmp 4516 36FE.tmp 3716 377B.tmp 2420 37F8.tmp 972 3875.tmp 2608 38E2.tmp 3284 3940.tmp 4712 39AD.tmp 3788 3A1B.tmp 4968 3A98.tmp 1300 3B05.tmp 1408 3B73.tmp 5052 3BE0.tmp 2536 3C2E.tmp 512 3CAB.tmp 812 3D09.tmp 4420 3D67.tmp 5060 3DC4.tmp 3856 3E32.tmp 2644 3E8F.tmp 3908 3F0C.tmp 4740 3F7A.tmp 3980 3FC8.tmp 1488 4016.tmp 4052 4064.tmp 3048 40D2.tmp 956 4120.tmp 3580 416E.tmp 924 41CC.tmp 4504 421A.tmp 1960 4277.tmp 3764 42C6.tmp 4260 4314.tmp 2308 4352.tmp 220 43A0.tmp 2200 43EE.tmp 3400 443D.tmp 1368 448B.tmp 2340 44D9.tmp 4444 4527.tmp 1124 4575.tmp 2480 45D3.tmp 4512 4621.tmp 4336 467F.tmp 3176 46CD.tmp 4664 472B.tmp 5048 4788.tmp 3624 47D6.tmp 4432 4825.tmp 3312 4882.tmp 2984 48D0.tmp 3720 492E.tmp 5016 498C.tmp 2196 49DA.tmp 392 4A28.tmp 3020 4A76.tmp 440 4AC4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3868 wrote to memory of 4452 3868 2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe 83 PID 3868 wrote to memory of 4452 3868 2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe 83 PID 3868 wrote to memory of 4452 3868 2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe 83 PID 4452 wrote to memory of 1140 4452 32E7.tmp 84 PID 4452 wrote to memory of 1140 4452 32E7.tmp 84 PID 4452 wrote to memory of 1140 4452 32E7.tmp 84 PID 1140 wrote to memory of 1376 1140 3383.tmp 85 PID 1140 wrote to memory of 1376 1140 3383.tmp 85 PID 1140 wrote to memory of 1376 1140 3383.tmp 85 PID 1376 wrote to memory of 212 1376 33F1.tmp 88 PID 1376 wrote to memory of 212 1376 33F1.tmp 88 PID 1376 wrote to memory of 212 1376 33F1.tmp 88 PID 212 wrote to memory of 3720 212 348D.tmp 90 PID 212 wrote to memory of 3720 212 348D.tmp 90 PID 212 wrote to memory of 3720 212 348D.tmp 90 PID 3720 wrote to memory of 3168 3720 350A.tmp 91 PID 3720 wrote to memory of 3168 3720 350A.tmp 91 PID 3720 wrote to memory of 3168 3720 350A.tmp 91 PID 3168 wrote to memory of 2832 3168 3587.tmp 92 PID 3168 wrote to memory of 2832 3168 3587.tmp 92 PID 3168 wrote to memory of 2832 3168 3587.tmp 92 PID 2832 wrote to memory of 2112 2832 3623.tmp 93 PID 2832 wrote to memory of 2112 2832 3623.tmp 93 PID 2832 wrote to memory of 2112 2832 3623.tmp 93 PID 2112 wrote to memory of 4516 2112 36B0.tmp 94 PID 2112 wrote to memory of 4516 2112 36B0.tmp 94 PID 2112 wrote to memory of 4516 2112 36B0.tmp 94 PID 4516 wrote to memory of 3716 4516 36FE.tmp 95 PID 4516 wrote to memory of 3716 4516 36FE.tmp 95 PID 4516 wrote to memory of 3716 4516 36FE.tmp 95 PID 3716 wrote to memory of 2420 3716 377B.tmp 96 PID 3716 wrote to memory of 2420 3716 377B.tmp 96 PID 3716 wrote to memory of 2420 3716 377B.tmp 96 PID 2420 wrote to memory of 972 2420 37F8.tmp 97 PID 2420 wrote to memory of 972 2420 37F8.tmp 97 PID 2420 wrote to memory of 972 2420 37F8.tmp 97 PID 972 wrote to memory of 2608 972 3875.tmp 98 PID 972 wrote to memory of 2608 972 3875.tmp 98 PID 972 wrote to memory of 2608 972 3875.tmp 98 PID 2608 wrote to memory of 3284 2608 38E2.tmp 99 PID 2608 wrote to memory of 3284 2608 38E2.tmp 99 PID 2608 wrote to memory of 3284 2608 38E2.tmp 99 PID 3284 wrote to memory of 4712 3284 3940.tmp 100 PID 3284 wrote to memory of 4712 3284 3940.tmp 100 PID 3284 wrote to memory of 4712 3284 3940.tmp 100 PID 4712 wrote to memory of 3788 4712 39AD.tmp 101 PID 4712 wrote to memory of 3788 4712 39AD.tmp 101 PID 4712 wrote to memory of 3788 4712 39AD.tmp 101 PID 3788 wrote to memory of 4968 3788 3A1B.tmp 102 PID 3788 wrote to memory of 4968 3788 3A1B.tmp 102 PID 3788 wrote to memory of 4968 3788 3A1B.tmp 102 PID 4968 wrote to memory of 1300 4968 3A98.tmp 103 PID 4968 wrote to memory of 1300 4968 3A98.tmp 103 PID 4968 wrote to memory of 1300 4968 3A98.tmp 103 PID 1300 wrote to memory of 1408 1300 3B05.tmp 104 PID 1300 wrote to memory of 1408 1300 3B05.tmp 104 PID 1300 wrote to memory of 1408 1300 3B05.tmp 104 PID 1408 wrote to memory of 5052 1408 3B73.tmp 105 PID 1408 wrote to memory of 5052 1408 3B73.tmp 105 PID 1408 wrote to memory of 5052 1408 3B73.tmp 105 PID 5052 wrote to memory of 2536 5052 3BE0.tmp 106 PID 5052 wrote to memory of 2536 5052 3BE0.tmp 106 PID 5052 wrote to memory of 2536 5052 3BE0.tmp 106 PID 2536 wrote to memory of 512 2536 3C2E.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-29_8f4473212c08542a9e34c778ffed9f53_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\3383.tmp"C:\Users\Admin\AppData\Local\Temp\3383.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\33F1.tmp"C:\Users\Admin\AppData\Local\Temp\33F1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\348D.tmp"C:\Users\Admin\AppData\Local\Temp\348D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Users\Admin\AppData\Local\Temp\350A.tmp"C:\Users\Admin\AppData\Local\Temp\350A.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\3587.tmp"C:\Users\Admin\AppData\Local\Temp\3587.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\3623.tmp"C:\Users\Admin\AppData\Local\Temp\3623.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\36B0.tmp"C:\Users\Admin\AppData\Local\Temp\36B0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\377B.tmp"C:\Users\Admin\AppData\Local\Temp\377B.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\3875.tmp"C:\Users\Admin\AppData\Local\Temp\3875.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\38E2.tmp"C:\Users\Admin\AppData\Local\Temp\38E2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\3A98.tmp"C:\Users\Admin\AppData\Local\Temp\3A98.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"C:\Users\Admin\AppData\Local\Temp\3C2E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"23⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"24⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"25⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"26⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"27⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"C:\Users\Admin\AppData\Local\Temp\3E8F.tmp"28⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"C:\Users\Admin\AppData\Local\Temp\3F0C.tmp"29⤵
- Executes dropped EXE
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"30⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"C:\Users\Admin\AppData\Local\Temp\3FC8.tmp"31⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\4016.tmp"C:\Users\Admin\AppData\Local\Temp\4016.tmp"32⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"33⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"34⤵
- Executes dropped EXE
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"35⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"36⤵
- Executes dropped EXE
PID:3580 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"37⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"38⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"39⤵
- Executes dropped EXE
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"40⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"41⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"42⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"43⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"44⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"45⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\448B.tmp"C:\Users\Admin\AppData\Local\Temp\448B.tmp"46⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"47⤵
- Executes dropped EXE
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\4527.tmp"C:\Users\Admin\AppData\Local\Temp\4527.tmp"48⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"49⤵
- Executes dropped EXE
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"50⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"51⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"52⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"53⤵
- Executes dropped EXE
PID:3176 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"54⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"55⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"56⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"57⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"58⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"59⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"60⤵
- Executes dropped EXE
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"61⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"62⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"63⤵
- Executes dropped EXE
PID:392 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"64⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"65⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"66⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"67⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"68⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"69⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"70⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"71⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"72⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"73⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"74⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"75⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"76⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"77⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"78⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"79⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"80⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"81⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"82⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"83⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"84⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"85⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"86⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"87⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"88⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"89⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"90⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"91⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"92⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"93⤵PID:3932
-
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"94⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"95⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"96⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"97⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"98⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"99⤵PID:1804
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"100⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"101⤵PID:2160
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"102⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"103⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"104⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\5803.tmp"C:\Users\Admin\AppData\Local\Temp\5803.tmp"105⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"106⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"107⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"108⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"109⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"110⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"111⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"112⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"113⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5B01.tmp"C:\Users\Admin\AppData\Local\Temp\5B01.tmp"114⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"115⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"116⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"117⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"118⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"119⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"120⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"121⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"122⤵PID:3612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-