Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 23:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe
-
Size
486KB
-
MD5
a5f95038b51dc9adba9aeb47dac5d133
-
SHA1
e5ee9a4c3cff5cf14838fd7efc3f5403432ad991
-
SHA256
a8ea778350cf763851756351301e355344816a329c25888cafc3d45e6b20a35a
-
SHA512
b57bd28c711cb9d879b61fa5657e8305d9c9a65d56f6be71d2895d257608f2dc7f792a87c382dce077c506ab66ae0126ade1ef9e0cb5e8dd8e94737f58abd07c
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7KJBkuKCLnWDG/x24p5Qt/FIpAkUjuxnZN0E4:/U5rCOTeiDKvxrSgekg+ZN0E2NZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5052 4631.tmp 3864 46AE.tmp 1376 472B.tmp 2660 4779.tmp 3472 47D6.tmp 5092 4844.tmp 2692 4892.tmp 2000 48F0.tmp 4868 493E.tmp 1576 498C.tmp 4848 49EA.tmp 4320 4A38.tmp 2476 4A86.tmp 4940 4AF3.tmp 920 4B41.tmp 2124 4B9F.tmp 3612 4BED.tmp 1764 4C4B.tmp 1128 4C99.tmp 1264 4D16.tmp 4372 4D64.tmp 1748 4DB2.tmp 5032 4E10.tmp 4176 4E7E.tmp 4708 4EDB.tmp 2568 4F29.tmp 4160 51C9.tmp 1456 5246.tmp 4888 5294.tmp 2900 52F2.tmp 3828 5350.tmp 1204 53AE.tmp 2552 53FC.tmp 4556 544A.tmp 2072 54F6.tmp 5100 5544.tmp 4664 5592.tmp 4828 55E0.tmp 4684 562E.tmp 2032 568C.tmp 3980 56DA.tmp 5064 5738.tmp 4464 5786.tmp 3100 57E4.tmp 3024 5842.tmp 1528 589F.tmp 2040 58ED.tmp 212 594B.tmp 3292 59A9.tmp 4936 5A07.tmp 1668 5A64.tmp 4524 5AB3.tmp 1072 5B10.tmp 3472 5B5E.tmp 3184 5BBC.tmp 1252 5C1A.tmp 2692 5C68.tmp 3780 5CB6.tmp 1740 5D04.tmp 4492 5D62.tmp 4868 5DB0.tmp 4120 5E0E.tmp 2640 5E6C.tmp 2268 5EBA.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4368 wrote to memory of 5052 4368 2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe 86 PID 4368 wrote to memory of 5052 4368 2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe 86 PID 4368 wrote to memory of 5052 4368 2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe 86 PID 5052 wrote to memory of 3864 5052 4631.tmp 88 PID 5052 wrote to memory of 3864 5052 4631.tmp 88 PID 5052 wrote to memory of 3864 5052 4631.tmp 88 PID 3864 wrote to memory of 1376 3864 46AE.tmp 89 PID 3864 wrote to memory of 1376 3864 46AE.tmp 89 PID 3864 wrote to memory of 1376 3864 46AE.tmp 89 PID 1376 wrote to memory of 2660 1376 472B.tmp 91 PID 1376 wrote to memory of 2660 1376 472B.tmp 91 PID 1376 wrote to memory of 2660 1376 472B.tmp 91 PID 2660 wrote to memory of 3472 2660 4779.tmp 92 PID 2660 wrote to memory of 3472 2660 4779.tmp 92 PID 2660 wrote to memory of 3472 2660 4779.tmp 92 PID 3472 wrote to memory of 5092 3472 47D6.tmp 93 PID 3472 wrote to memory of 5092 3472 47D6.tmp 93 PID 3472 wrote to memory of 5092 3472 47D6.tmp 93 PID 5092 wrote to memory of 2692 5092 4844.tmp 94 PID 5092 wrote to memory of 2692 5092 4844.tmp 94 PID 5092 wrote to memory of 2692 5092 4844.tmp 94 PID 2692 wrote to memory of 2000 2692 4892.tmp 95 PID 2692 wrote to memory of 2000 2692 4892.tmp 95 PID 2692 wrote to memory of 2000 2692 4892.tmp 95 PID 2000 wrote to memory of 4868 2000 48F0.tmp 96 PID 2000 wrote to memory of 4868 2000 48F0.tmp 96 PID 2000 wrote to memory of 4868 2000 48F0.tmp 96 PID 4868 wrote to memory of 1576 4868 493E.tmp 97 PID 4868 wrote to memory of 1576 4868 493E.tmp 97 PID 4868 wrote to memory of 1576 4868 493E.tmp 97 PID 1576 wrote to memory of 4848 1576 498C.tmp 98 PID 1576 wrote to memory of 4848 1576 498C.tmp 98 PID 1576 wrote to memory of 4848 1576 498C.tmp 98 PID 4848 wrote to memory of 4320 4848 49EA.tmp 99 PID 4848 wrote to memory of 4320 4848 49EA.tmp 99 PID 4848 wrote to memory of 4320 4848 49EA.tmp 99 PID 4320 wrote to memory of 2476 4320 4A38.tmp 100 PID 4320 wrote to memory of 2476 4320 4A38.tmp 100 PID 4320 wrote to memory of 2476 4320 4A38.tmp 100 PID 2476 wrote to memory of 4940 2476 4A86.tmp 101 PID 2476 wrote to memory of 4940 2476 4A86.tmp 101 PID 2476 wrote to memory of 4940 2476 4A86.tmp 101 PID 4940 wrote to memory of 920 4940 4AF3.tmp 102 PID 4940 wrote to memory of 920 4940 4AF3.tmp 102 PID 4940 wrote to memory of 920 4940 4AF3.tmp 102 PID 920 wrote to memory of 2124 920 4B41.tmp 103 PID 920 wrote to memory of 2124 920 4B41.tmp 103 PID 920 wrote to memory of 2124 920 4B41.tmp 103 PID 2124 wrote to memory of 3612 2124 4B9F.tmp 104 PID 2124 wrote to memory of 3612 2124 4B9F.tmp 104 PID 2124 wrote to memory of 3612 2124 4B9F.tmp 104 PID 3612 wrote to memory of 1764 3612 4BED.tmp 105 PID 3612 wrote to memory of 1764 3612 4BED.tmp 105 PID 3612 wrote to memory of 1764 3612 4BED.tmp 105 PID 1764 wrote to memory of 1128 1764 4C4B.tmp 106 PID 1764 wrote to memory of 1128 1764 4C4B.tmp 106 PID 1764 wrote to memory of 1128 1764 4C4B.tmp 106 PID 1128 wrote to memory of 1264 1128 4C99.tmp 107 PID 1128 wrote to memory of 1264 1128 4C99.tmp 107 PID 1128 wrote to memory of 1264 1128 4C99.tmp 107 PID 1264 wrote to memory of 4372 1264 4D16.tmp 109 PID 1264 wrote to memory of 4372 1264 4D16.tmp 109 PID 1264 wrote to memory of 4372 1264 4D16.tmp 109 PID 4372 wrote to memory of 1748 4372 4D64.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-18_a5f95038b51dc9adba9aeb47dac5d133_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\47D6.tmp"C:\Users\Admin\AppData\Local\Temp\47D6.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4844.tmp"C:\Users\Admin\AppData\Local\Temp\4844.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4892.tmp"C:\Users\Admin\AppData\Local\Temp\4892.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\4A86.tmp"C:\Users\Admin\AppData\Local\Temp\4A86.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\4C99.tmp"C:\Users\Admin\AppData\Local\Temp\4C99.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"1⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"2⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"3⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"4⤵
- Executes dropped EXE
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"5⤵
- Executes dropped EXE
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"6⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"7⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"8⤵
- Executes dropped EXE
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"9⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"10⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"11⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"12⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"13⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"14⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"15⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"16⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"17⤵
- Executes dropped EXE
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"18⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"19⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"20⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"21⤵
- Executes dropped EXE
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"22⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"23⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"24⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"25⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"26⤵
- Executes dropped EXE
PID:2040 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"27⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"28⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"29⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"30⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"31⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"32⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"33⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"34⤵
- Executes dropped EXE
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"35⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"36⤵
- Executes dropped EXE
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"37⤵
- Executes dropped EXE
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"38⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"39⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"40⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"41⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"42⤵
- Executes dropped EXE
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"43⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"44⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"45⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"46⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"47⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"48⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"49⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"50⤵PID:2688
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"51⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"52⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"53⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"54⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"55⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"56⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"57⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"58⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"59⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"60⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"61⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"62⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"63⤵PID:2236
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"64⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"65⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"66⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"67⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"68⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"69⤵PID:4744
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"70⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"71⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"72⤵PID:2748
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"73⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"74⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"75⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"76⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"77⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"78⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"79⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"80⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"81⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"82⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"83⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"84⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"85⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"86⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"87⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"88⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"89⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"90⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"91⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"92⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"93⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"94⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"95⤵PID:644
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"96⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"97⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"98⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"99⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"100⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"101⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"102⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"103⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\7232.tmp"C:\Users\Admin\AppData\Local\Temp\7232.tmp"104⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\7280.tmp"C:\Users\Admin\AppData\Local\Temp\7280.tmp"105⤵PID:3216
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"106⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"107⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"108⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"109⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\7426.tmp"C:\Users\Admin\AppData\Local\Temp\7426.tmp"110⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"111⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"112⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"113⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"114⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"115⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"116⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"117⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"118⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"119⤵PID:4716
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"120⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"121⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\77FF.tmp"C:\Users\Admin\AppData\Local\Temp\77FF.tmp"122⤵PID:3600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-