Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
28-04-2024 06:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe
-
Size
488KB
-
MD5
3b011e42ed7781ea216876c0c3d75228
-
SHA1
d76f093505a105590bcf58c7eda4e332eb9ddcfb
-
SHA256
b4bdbb9db377c9bfbdfd2c4c90fcf3a5fd5d3892d4055794f0612febf64f1c1d
-
SHA512
0fd58324f3bdd2e42bad7ceb8425ea864847564a49d532dc40f825f6cade76af01cd0c40265959045c49613f64cc7ca7b32c8afb981c85e07d606f7fb6e1d941
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7nwK6gWCCXdH2rsLTZa+saNHxIPHZb44x2U3q:/U5rCOTeiDR9EpKcF/sasPH+4xJL4NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2492 3AB7.tmp 3528 3B15.tmp 2776 3B73.tmp 404 3BF0.tmp 4380 3C5D.tmp 3716 3CBB.tmp 4332 3D47.tmp 4652 3DD4.tmp 1052 3E32.tmp 3012 3E80.tmp 1672 3EED.tmp 2660 3F3B.tmp 628 3FA9.tmp 4092 3FF7.tmp 4992 4074.tmp 3884 40E1.tmp 2612 414F.tmp 952 41BC.tmp 2208 421A.tmp 1228 4277.tmp 1592 42E5.tmp 5048 4362.tmp 2032 43DF.tmp 1900 443D.tmp 3308 449A.tmp 3468 44E8.tmp 1140 4537.tmp 2548 4594.tmp 2908 45F2.tmp 3340 467F.tmp 2288 46FC.tmp 3740 4769.tmp 4296 47C7.tmp 2616 4825.tmp 3212 4873.tmp 4152 48D0.tmp 1984 491F.tmp 4712 496D.tmp 3552 49BB.tmp 1668 4A09.tmp 4444 4A57.tmp 3700 4AB5.tmp 1660 4B03.tmp 4336 4B51.tmp 1720 4BAF.tmp 1404 4BFD.tmp 4832 4C4B.tmp 636 4C99.tmp 408 4CE7.tmp 3368 4D35.tmp 4752 4D93.tmp 4420 4DF1.tmp 3068 4E3F.tmp 3460 4E8D.tmp 704 4EEB.tmp 4808 4F49.tmp 3168 4F97.tmp 2180 4FE5.tmp 1040 5023.tmp 4964 5072.tmp 3824 50C0.tmp 4408 510E.tmp 2488 515C.tmp 1608 51BA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1404 wrote to memory of 2492 1404 2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe 84 PID 1404 wrote to memory of 2492 1404 2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe 84 PID 1404 wrote to memory of 2492 1404 2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe 84 PID 2492 wrote to memory of 3528 2492 3AB7.tmp 85 PID 2492 wrote to memory of 3528 2492 3AB7.tmp 85 PID 2492 wrote to memory of 3528 2492 3AB7.tmp 85 PID 3528 wrote to memory of 2776 3528 3B15.tmp 86 PID 3528 wrote to memory of 2776 3528 3B15.tmp 86 PID 3528 wrote to memory of 2776 3528 3B15.tmp 86 PID 2776 wrote to memory of 404 2776 3B73.tmp 87 PID 2776 wrote to memory of 404 2776 3B73.tmp 87 PID 2776 wrote to memory of 404 2776 3B73.tmp 87 PID 404 wrote to memory of 4380 404 3BF0.tmp 89 PID 404 wrote to memory of 4380 404 3BF0.tmp 89 PID 404 wrote to memory of 4380 404 3BF0.tmp 89 PID 4380 wrote to memory of 3716 4380 3C5D.tmp 90 PID 4380 wrote to memory of 3716 4380 3C5D.tmp 90 PID 4380 wrote to memory of 3716 4380 3C5D.tmp 90 PID 3716 wrote to memory of 4332 3716 3CBB.tmp 92 PID 3716 wrote to memory of 4332 3716 3CBB.tmp 92 PID 3716 wrote to memory of 4332 3716 3CBB.tmp 92 PID 4332 wrote to memory of 4652 4332 3D47.tmp 94 PID 4332 wrote to memory of 4652 4332 3D47.tmp 94 PID 4332 wrote to memory of 4652 4332 3D47.tmp 94 PID 4652 wrote to memory of 1052 4652 3DD4.tmp 95 PID 4652 wrote to memory of 1052 4652 3DD4.tmp 95 PID 4652 wrote to memory of 1052 4652 3DD4.tmp 95 PID 1052 wrote to memory of 3012 1052 3E32.tmp 96 PID 1052 wrote to memory of 3012 1052 3E32.tmp 96 PID 1052 wrote to memory of 3012 1052 3E32.tmp 96 PID 3012 wrote to memory of 1672 3012 3E80.tmp 97 PID 3012 wrote to memory of 1672 3012 3E80.tmp 97 PID 3012 wrote to memory of 1672 3012 3E80.tmp 97 PID 1672 wrote to memory of 2660 1672 3EED.tmp 98 PID 1672 wrote to memory of 2660 1672 3EED.tmp 98 PID 1672 wrote to memory of 2660 1672 3EED.tmp 98 PID 2660 wrote to memory of 628 2660 3F3B.tmp 99 PID 2660 wrote to memory of 628 2660 3F3B.tmp 99 PID 2660 wrote to memory of 628 2660 3F3B.tmp 99 PID 628 wrote to memory of 4092 628 3FA9.tmp 100 PID 628 wrote to memory of 4092 628 3FA9.tmp 100 PID 628 wrote to memory of 4092 628 3FA9.tmp 100 PID 4092 wrote to memory of 4992 4092 3FF7.tmp 101 PID 4092 wrote to memory of 4992 4092 3FF7.tmp 101 PID 4092 wrote to memory of 4992 4092 3FF7.tmp 101 PID 4992 wrote to memory of 3884 4992 4074.tmp 102 PID 4992 wrote to memory of 3884 4992 4074.tmp 102 PID 4992 wrote to memory of 3884 4992 4074.tmp 102 PID 3884 wrote to memory of 2612 3884 40E1.tmp 103 PID 3884 wrote to memory of 2612 3884 40E1.tmp 103 PID 3884 wrote to memory of 2612 3884 40E1.tmp 103 PID 2612 wrote to memory of 952 2612 414F.tmp 104 PID 2612 wrote to memory of 952 2612 414F.tmp 104 PID 2612 wrote to memory of 952 2612 414F.tmp 104 PID 952 wrote to memory of 2208 952 41BC.tmp 105 PID 952 wrote to memory of 2208 952 41BC.tmp 105 PID 952 wrote to memory of 2208 952 41BC.tmp 105 PID 2208 wrote to memory of 1228 2208 421A.tmp 106 PID 2208 wrote to memory of 1228 2208 421A.tmp 106 PID 2208 wrote to memory of 1228 2208 421A.tmp 106 PID 1228 wrote to memory of 1592 1228 4277.tmp 107 PID 1228 wrote to memory of 1592 1228 4277.tmp 107 PID 1228 wrote to memory of 1592 1228 4277.tmp 107 PID 1592 wrote to memory of 5048 1592 42E5.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-28_3b011e42ed7781ea216876c0c3d75228_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\3B15.tmp"C:\Users\Admin\AppData\Local\Temp\3B15.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"C:\Users\Admin\AppData\Local\Temp\3CBB.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\3D47.tmp"C:\Users\Admin\AppData\Local\Temp\3D47.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"C:\Users\Admin\AppData\Local\Temp\3FA9.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"C:\Users\Admin\AppData\Local\Temp\3FF7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"23⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"24⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"25⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"26⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"27⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"28⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"29⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"30⤵
- Executes dropped EXE
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\467F.tmp"C:\Users\Admin\AppData\Local\Temp\467F.tmp"31⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"32⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\4769.tmp"C:\Users\Admin\AppData\Local\Temp\4769.tmp"33⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"34⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"35⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"36⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"37⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"38⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"39⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"40⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"41⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"42⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"43⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\4B03.tmp"C:\Users\Admin\AppData\Local\Temp\4B03.tmp"44⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\4B51.tmp"C:\Users\Admin\AppData\Local\Temp\4B51.tmp"45⤵
- Executes dropped EXE
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"46⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"47⤵
- Executes dropped EXE
PID:1404 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"48⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"49⤵
- Executes dropped EXE
PID:636 -
C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"C:\Users\Admin\AppData\Local\Temp\4CE7.tmp"50⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"51⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"52⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"53⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"54⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"55⤵
- Executes dropped EXE
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"56⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"57⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"58⤵
- Executes dropped EXE
PID:3168 -
C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"C:\Users\Admin\AppData\Local\Temp\4FE5.tmp"59⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\5023.tmp"C:\Users\Admin\AppData\Local\Temp\5023.tmp"60⤵
- Executes dropped EXE
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"61⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"62⤵
- Executes dropped EXE
PID:3824 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"63⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"64⤵
- Executes dropped EXE
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"65⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"66⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"67⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"68⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"69⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"70⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"71⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"72⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"73⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"74⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"75⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"76⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"77⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"78⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"79⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"80⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"81⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"82⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"83⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"84⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"85⤵PID:4060
-
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"86⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"87⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"88⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"89⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"90⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"91⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"92⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"93⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"94⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"95⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"96⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"97⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"98⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"99⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"100⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"101⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"102⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"103⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"104⤵PID:676
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"105⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"106⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"107⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"108⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"109⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"110⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"111⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"112⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"113⤵PID:2076
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"114⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"115⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"116⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"117⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"118⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"120⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"121⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"122⤵PID:5040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-