Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20-05-2024 19:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe
-
Size
541KB
-
MD5
e236a1b9176bc2931e358a7a354b40ba
-
SHA1
e7bbfaf5c3cff5d62edb9e94b4ea8d6054acc4f5
-
SHA256
ef7d69bace0a2f3234fe258c71a08207a22360717c29ecb49c8b212323767cc2
-
SHA512
92db52210b58632bf36837ae2fcfc3f91504710013c485853455025d6a39d9cfbb1e5bc5c24473db84c92c38e39dc19e59e3961a96ace9a5c9d0ee82c39d8ba6
-
SSDEEP
12288:UU5rCOTeifU9SepTg+0K9bD/NYrPnHvXJa3rZa73ctO:UUQOJfU9SL+0+RYrPno3rU73ctO
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2940 39BD.tmp 4832 3A59.tmp 888 3AD6.tmp 3344 3B73.tmp 1124 3BFF.tmp 3348 3C5D.tmp 5040 3CDA.tmp 3016 3D67.tmp 4528 3DD4.tmp 3544 3E32.tmp 4788 3E9F.tmp 5016 3EFD.tmp 4864 3F5B.tmp 4092 3FB8.tmp 3404 4026.tmp 4036 4083.tmp 2252 40D2.tmp 3004 414F.tmp 1372 419D.tmp 1104 421A.tmp 1712 4297.tmp 2356 4304.tmp 3584 4362.tmp 1560 43C0.tmp 4076 440E.tmp 3956 446B.tmp 2480 44C9.tmp 1196 4517.tmp 3868 4565.tmp 2956 45D3.tmp 4216 4650.tmp 1952 46CD.tmp 1500 472B.tmp 4568 4788.tmp 2628 47F6.tmp 1736 4863.tmp 4344 48B1.tmp 1192 48FF.tmp 1936 494D.tmp 3828 49AB.tmp 4044 4A09.tmp 3644 4A67.tmp 5088 4AC4.tmp 1544 4B22.tmp 2012 4B80.tmp 4476 4BCE.tmp 2984 4C1C.tmp 4140 4C7A.tmp 4944 4CD8.tmp 1092 4D26.tmp 644 4D84.tmp 3196 4DE1.tmp 4248 4E2F.tmp 4448 4E7E.tmp 1920 4ECC.tmp 1264 4F29.tmp 936 4F78.tmp 4984 4FD5.tmp 1704 5033.tmp 2356 5081.tmp 2800 50DF.tmp 3480 514C.tmp 1560 519A.tmp 4076 51F8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 368 wrote to memory of 2940 368 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 83 PID 368 wrote to memory of 2940 368 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 83 PID 368 wrote to memory of 2940 368 2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe 83 PID 2940 wrote to memory of 4832 2940 39BD.tmp 84 PID 2940 wrote to memory of 4832 2940 39BD.tmp 84 PID 2940 wrote to memory of 4832 2940 39BD.tmp 84 PID 4832 wrote to memory of 888 4832 3A59.tmp 85 PID 4832 wrote to memory of 888 4832 3A59.tmp 85 PID 4832 wrote to memory of 888 4832 3A59.tmp 85 PID 888 wrote to memory of 3344 888 3AD6.tmp 86 PID 888 wrote to memory of 3344 888 3AD6.tmp 86 PID 888 wrote to memory of 3344 888 3AD6.tmp 86 PID 3344 wrote to memory of 1124 3344 3B73.tmp 87 PID 3344 wrote to memory of 1124 3344 3B73.tmp 87 PID 3344 wrote to memory of 1124 3344 3B73.tmp 87 PID 1124 wrote to memory of 3348 1124 3BFF.tmp 89 PID 1124 wrote to memory of 3348 1124 3BFF.tmp 89 PID 1124 wrote to memory of 3348 1124 3BFF.tmp 89 PID 3348 wrote to memory of 5040 3348 3C5D.tmp 90 PID 3348 wrote to memory of 5040 3348 3C5D.tmp 90 PID 3348 wrote to memory of 5040 3348 3C5D.tmp 90 PID 5040 wrote to memory of 3016 5040 3CDA.tmp 92 PID 5040 wrote to memory of 3016 5040 3CDA.tmp 92 PID 5040 wrote to memory of 3016 5040 3CDA.tmp 92 PID 3016 wrote to memory of 4528 3016 3D67.tmp 93 PID 3016 wrote to memory of 4528 3016 3D67.tmp 93 PID 3016 wrote to memory of 4528 3016 3D67.tmp 93 PID 4528 wrote to memory of 3544 4528 3DD4.tmp 94 PID 4528 wrote to memory of 3544 4528 3DD4.tmp 94 PID 4528 wrote to memory of 3544 4528 3DD4.tmp 94 PID 3544 wrote to memory of 4788 3544 3E32.tmp 95 PID 3544 wrote to memory of 4788 3544 3E32.tmp 95 PID 3544 wrote to memory of 4788 3544 3E32.tmp 95 PID 4788 wrote to memory of 5016 4788 3E9F.tmp 96 PID 4788 wrote to memory of 5016 4788 3E9F.tmp 96 PID 4788 wrote to memory of 5016 4788 3E9F.tmp 96 PID 5016 wrote to memory of 4864 5016 3EFD.tmp 97 PID 5016 wrote to memory of 4864 5016 3EFD.tmp 97 PID 5016 wrote to memory of 4864 5016 3EFD.tmp 97 PID 4864 wrote to memory of 4092 4864 3F5B.tmp 98 PID 4864 wrote to memory of 4092 4864 3F5B.tmp 98 PID 4864 wrote to memory of 4092 4864 3F5B.tmp 98 PID 4092 wrote to memory of 3404 4092 3FB8.tmp 99 PID 4092 wrote to memory of 3404 4092 3FB8.tmp 99 PID 4092 wrote to memory of 3404 4092 3FB8.tmp 99 PID 3404 wrote to memory of 4036 3404 4026.tmp 100 PID 3404 wrote to memory of 4036 3404 4026.tmp 100 PID 3404 wrote to memory of 4036 3404 4026.tmp 100 PID 4036 wrote to memory of 2252 4036 4083.tmp 101 PID 4036 wrote to memory of 2252 4036 4083.tmp 101 PID 4036 wrote to memory of 2252 4036 4083.tmp 101 PID 2252 wrote to memory of 3004 2252 40D2.tmp 102 PID 2252 wrote to memory of 3004 2252 40D2.tmp 102 PID 2252 wrote to memory of 3004 2252 40D2.tmp 102 PID 3004 wrote to memory of 1372 3004 414F.tmp 103 PID 3004 wrote to memory of 1372 3004 414F.tmp 103 PID 3004 wrote to memory of 1372 3004 414F.tmp 103 PID 1372 wrote to memory of 1104 1372 419D.tmp 104 PID 1372 wrote to memory of 1104 1372 419D.tmp 104 PID 1372 wrote to memory of 1104 1372 419D.tmp 104 PID 1104 wrote to memory of 1712 1104 421A.tmp 105 PID 1104 wrote to memory of 1712 1104 421A.tmp 105 PID 1104 wrote to memory of 1712 1104 421A.tmp 105 PID 1712 wrote to memory of 2356 1712 4297.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_e236a1b9176bc2931e358a7a354b40ba_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Users\Admin\AppData\Local\Temp\39BD.tmp"C:\Users\Admin\AppData\Local\Temp\39BD.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\3A59.tmp"C:\Users\Admin\AppData\Local\Temp\3A59.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"C:\Users\Admin\AppData\Local\Temp\3AD6.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Users\Admin\AppData\Local\Temp\3B73.tmp"C:\Users\Admin\AppData\Local\Temp\3B73.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"C:\Users\Admin\AppData\Local\Temp\3BFF.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"C:\Users\Admin\AppData\Local\Temp\3C5D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\3D67.tmp"C:\Users\Admin\AppData\Local\Temp\3D67.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\3E32.tmp"C:\Users\Admin\AppData\Local\Temp\3E32.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"C:\Users\Admin\AppData\Local\Temp\3EFD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"C:\Users\Admin\AppData\Local\Temp\3F5B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\4026.tmp"C:\Users\Admin\AppData\Local\Temp\4026.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\419D.tmp"C:\Users\Admin\AppData\Local\Temp\419D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\421A.tmp"C:\Users\Admin\AppData\Local\Temp\421A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"23⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"24⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"25⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\440E.tmp"C:\Users\Admin\AppData\Local\Temp\440E.tmp"26⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\446B.tmp"C:\Users\Admin\AppData\Local\Temp\446B.tmp"27⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"28⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"29⤵
- Executes dropped EXE
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"30⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"31⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"32⤵
- Executes dropped EXE
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"33⤵
- Executes dropped EXE
PID:1952 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"34⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"35⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"36⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"37⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"38⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"39⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"40⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"41⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"42⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"43⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"44⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"45⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"46⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"47⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"48⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"49⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"50⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"51⤵
- Executes dropped EXE
PID:1092 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"52⤵
- Executes dropped EXE
PID:644 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"53⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"54⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"55⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"56⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"57⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"58⤵
- Executes dropped EXE
PID:936 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"59⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"60⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"61⤵
- Executes dropped EXE
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"62⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"63⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"64⤵
- Executes dropped EXE
PID:1560 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"65⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"66⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"67⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"68⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"69⤵PID:2244
-
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"70⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"71⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"72⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"73⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"74⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"75⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"76⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"77⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"78⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"79⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"80⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"81⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"82⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"83⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"84⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"85⤵PID:1604
-
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"86⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"87⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"88⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"89⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"90⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"91⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"92⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"93⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"94⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"95⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"96⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"C:\Users\Admin\AppData\Local\Temp\5DA1.tmp"97⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"98⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"99⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"100⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"101⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"102⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"103⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"104⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"105⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"106⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"107⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"108⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"109⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"110⤵PID:3480
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"111⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"112⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"113⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"114⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"115⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"116⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"117⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"118⤵PID:840
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"119⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"120⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"121⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"122⤵PID:2112
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-