Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
27-04-2024 18:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe
-
Size
486KB
-
MD5
601931f6f76e72a74baab85fcfd20583
-
SHA1
7defe4d0c0400bffb7f67996e177d8e5364e2a6f
-
SHA256
b6b394591b5b323770e83dba8e4a640f6e79fb7555b8ae023e86e2cc8522f3eb
-
SHA512
d0d30eb400298ef4bfb791b631727430775ceb5698eeae4188519a2b4f7058934b07a083815db6478cc58366ccccaa88a8e6754463d399633a62bc9fa2a33ac4
-
SSDEEP
12288:UU5rCOTeiDy0J9M7BxCCHTMuip9jiZq+NuNZ:UUQOJDyuQfCHuegAzN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1028 36CF.tmp 3172 373C.tmp 1884 37C9.tmp 2072 3865.tmp 2160 38C3.tmp 3116 3940.tmp 460 39AD.tmp 2704 3A1B.tmp 3196 3A69.tmp 2132 3AC7.tmp 1372 3B44.tmp 4180 3B92.tmp 4892 3BFF.tmp 4352 3C4D.tmp 1740 3CBB.tmp 2392 3D09.tmp 3652 3D57.tmp 5080 3DD4.tmp 4036 3E41.tmp 2184 3EBE.tmp 1972 3F1C.tmp 2580 3F7A.tmp 3648 3FD8.tmp 1912 4026.tmp 3956 40A3.tmp 2536 4100.tmp 4468 417D.tmp 428 41FA.tmp 3964 4258.tmp 3732 42B6.tmp 3372 4343.tmp 3940 43A0.tmp 4396 43FE.tmp 4712 444C.tmp 4932 449A.tmp 116 44F8.tmp 1432 4556.tmp 4504 45A4.tmp 2276 4602.tmp 1100 465F.tmp 4432 46BD.tmp 432 470B.tmp 4312 4759.tmp 4696 47B7.tmp 1880 4815.tmp 1276 4863.tmp 2264 48B1.tmp 3164 48FF.tmp 344 495D.tmp 4492 49AB.tmp 3752 49F9.tmp 4236 4A47.tmp 3800 4AA5.tmp 3120 4B03.tmp 2628 4B51.tmp 2760 4B9F.tmp 3604 4BFD.tmp 716 4C5B.tmp 4840 4CA9.tmp 5036 4D16.tmp 4512 4D64.tmp 4836 4DC2.tmp 2780 4E10.tmp 3080 4E5E.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 528 wrote to memory of 1028 528 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 83 PID 528 wrote to memory of 1028 528 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 83 PID 528 wrote to memory of 1028 528 2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe 83 PID 1028 wrote to memory of 3172 1028 36CF.tmp 84 PID 1028 wrote to memory of 3172 1028 36CF.tmp 84 PID 1028 wrote to memory of 3172 1028 36CF.tmp 84 PID 3172 wrote to memory of 1884 3172 373C.tmp 85 PID 3172 wrote to memory of 1884 3172 373C.tmp 85 PID 3172 wrote to memory of 1884 3172 373C.tmp 85 PID 1884 wrote to memory of 2072 1884 37C9.tmp 86 PID 1884 wrote to memory of 2072 1884 37C9.tmp 86 PID 1884 wrote to memory of 2072 1884 37C9.tmp 86 PID 2072 wrote to memory of 2160 2072 3865.tmp 88 PID 2072 wrote to memory of 2160 2072 3865.tmp 88 PID 2072 wrote to memory of 2160 2072 3865.tmp 88 PID 2160 wrote to memory of 3116 2160 38C3.tmp 90 PID 2160 wrote to memory of 3116 2160 38C3.tmp 90 PID 2160 wrote to memory of 3116 2160 38C3.tmp 90 PID 3116 wrote to memory of 460 3116 3940.tmp 92 PID 3116 wrote to memory of 460 3116 3940.tmp 92 PID 3116 wrote to memory of 460 3116 3940.tmp 92 PID 460 wrote to memory of 2704 460 39AD.tmp 93 PID 460 wrote to memory of 2704 460 39AD.tmp 93 PID 460 wrote to memory of 2704 460 39AD.tmp 93 PID 2704 wrote to memory of 3196 2704 3A1B.tmp 95 PID 2704 wrote to memory of 3196 2704 3A1B.tmp 95 PID 2704 wrote to memory of 3196 2704 3A1B.tmp 95 PID 3196 wrote to memory of 2132 3196 3A69.tmp 96 PID 3196 wrote to memory of 2132 3196 3A69.tmp 96 PID 3196 wrote to memory of 2132 3196 3A69.tmp 96 PID 2132 wrote to memory of 1372 2132 3AC7.tmp 97 PID 2132 wrote to memory of 1372 2132 3AC7.tmp 97 PID 2132 wrote to memory of 1372 2132 3AC7.tmp 97 PID 1372 wrote to memory of 4180 1372 3B44.tmp 98 PID 1372 wrote to memory of 4180 1372 3B44.tmp 98 PID 1372 wrote to memory of 4180 1372 3B44.tmp 98 PID 4180 wrote to memory of 4892 4180 3B92.tmp 99 PID 4180 wrote to memory of 4892 4180 3B92.tmp 99 PID 4180 wrote to memory of 4892 4180 3B92.tmp 99 PID 4892 wrote to memory of 4352 4892 3BFF.tmp 100 PID 4892 wrote to memory of 4352 4892 3BFF.tmp 100 PID 4892 wrote to memory of 4352 4892 3BFF.tmp 100 PID 4352 wrote to memory of 1740 4352 3C4D.tmp 101 PID 4352 wrote to memory of 1740 4352 3C4D.tmp 101 PID 4352 wrote to memory of 1740 4352 3C4D.tmp 101 PID 1740 wrote to memory of 2392 1740 3CBB.tmp 102 PID 1740 wrote to memory of 2392 1740 3CBB.tmp 102 PID 1740 wrote to memory of 2392 1740 3CBB.tmp 102 PID 2392 wrote to memory of 3652 2392 3D09.tmp 103 PID 2392 wrote to memory of 3652 2392 3D09.tmp 103 PID 2392 wrote to memory of 3652 2392 3D09.tmp 103 PID 3652 wrote to memory of 5080 3652 3D57.tmp 104 PID 3652 wrote to memory of 5080 3652 3D57.tmp 104 PID 3652 wrote to memory of 5080 3652 3D57.tmp 104 PID 5080 wrote to memory of 4036 5080 3DD4.tmp 105 PID 5080 wrote to memory of 4036 5080 3DD4.tmp 105 PID 5080 wrote to memory of 4036 5080 3DD4.tmp 105 PID 4036 wrote to memory of 2184 4036 3E41.tmp 106 PID 4036 wrote to memory of 2184 4036 3E41.tmp 106 PID 4036 wrote to memory of 2184 4036 3E41.tmp 106 PID 2184 wrote to memory of 1972 2184 3EBE.tmp 107 PID 2184 wrote to memory of 1972 2184 3EBE.tmp 107 PID 2184 wrote to memory of 1972 2184 3EBE.tmp 107 PID 1972 wrote to memory of 2580 1972 3F1C.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_601931f6f76e72a74baab85fcfd20583_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\373C.tmp"C:\Users\Admin\AppData\Local\Temp\373C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\3865.tmp"C:\Users\Admin\AppData\Local\Temp\3865.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\3B44.tmp"C:\Users\Admin\AppData\Local\Temp\3B44.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\3B92.tmp"C:\Users\Admin\AppData\Local\Temp\3B92.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"C:\Users\Admin\AppData\Local\Temp\3C4D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"C:\Users\Admin\AppData\Local\Temp\3EBE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"23⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"24⤵
- Executes dropped EXE
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"25⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\40A3.tmp"C:\Users\Admin\AppData\Local\Temp\40A3.tmp"26⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"27⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"28⤵
- Executes dropped EXE
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"29⤵
- Executes dropped EXE
PID:428 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"30⤵
- Executes dropped EXE
PID:3964 -
C:\Users\Admin\AppData\Local\Temp\42B6.tmp"C:\Users\Admin\AppData\Local\Temp\42B6.tmp"31⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"32⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"33⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"34⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"35⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"36⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"37⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"38⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"39⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"40⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"41⤵
- Executes dropped EXE
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"42⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"43⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"44⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"45⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"46⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"47⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"48⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"49⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"50⤵
- Executes dropped EXE
PID:344 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"51⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"52⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"53⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"C:\Users\Admin\AppData\Local\Temp\4AA5.tmp"54⤵
- Executes dropped EXE
PID:3800 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"55⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"56⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"57⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"58⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"59⤵
- Executes dropped EXE
PID:716 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"60⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"61⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"62⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"63⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"64⤵
- Executes dropped EXE
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"65⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"66⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"67⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"68⤵PID:4672
-
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"69⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"70⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"71⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"72⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"73⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"74⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"75⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"76⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"77⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"78⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"79⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"80⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"81⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"82⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"83⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"84⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"85⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"86⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"87⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"88⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"89⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"90⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"91⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"92⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"93⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"94⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"95⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"96⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"97⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"98⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"99⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"100⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"101⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"102⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"103⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"104⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"105⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"106⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"107⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"108⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"109⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"110⤵PID:528
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"111⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"112⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"113⤵PID:3164
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"114⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"115⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"116⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"117⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"118⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"119⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"120⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"121⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"122⤵PID:2816
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-