Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 14:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe
-
Size
536KB
-
MD5
131092f5edf23fc56d7072c0a3fa68e4
-
SHA1
9cb706225f104233f51a62ac5cf5621146eec2ac
-
SHA256
36988b24e3656ad3c880b36c94c5f5bfc375fce389b677e0b96de891322eb87b
-
SHA512
67992672cf10d54c062fe74c46979e456e39f69914be72964fb15d8c74ffb4bc266ca37ae3874b6e0db1b1aa13a4c5e5f65c7b2119d361681c0ea958342c71f3
-
SSDEEP
12288:wU5rCOTeiUUvJ9KRF2/rW2IjDkN7zV1KYQ6BIZxVJ0ZT9:wUQOJUgJ9KRkWxsNfBIRJ0ZT9
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
39EC.tmp3AA7.tmp3B34.tmp3BC1.tmp3C7C.tmp3D28.tmp3DC4.tmp3E70.tmp3EED.tmp3F6A.tmp4035.tmp40B2.tmp414F.tmp41FA.tmp4277.tmp4304.tmp4381.tmp43FE.tmp447B.tmp4517.tmp45B4.tmp4640.tmp46BD.tmp473A.tmp47A8.tmp4825.tmp48A2.tmp493E.tmp49BB.tmp4A38.tmp4AD4.tmp4B41.tmp4BDE.tmp4C3B.tmp4CB8.tmp4D16.tmp4D93.tmp4E10.tmp4E8D.tmp4F0A.tmp4F78.tmp4FF5.tmp5052.tmp50B0.tmp50FE.tmp515C.tmp51D9.tmp5237.tmp5294.tmp52E3.tmp5340.tmp539E.tmp53EC.tmp543A.tmp5498.tmp54E6.tmp5534.tmp5592.tmp55E0.tmp563E.tmp568C.tmp56DA.tmp5728.tmp5786.tmppid process 2924 39EC.tmp 5116 3AA7.tmp 4560 3B34.tmp 4004 3BC1.tmp 2436 3C7C.tmp 4808 3D28.tmp 4172 3DC4.tmp 4432 3E70.tmp 4032 3EED.tmp 448 3F6A.tmp 4924 4035.tmp 5036 40B2.tmp 1916 414F.tmp 1724 41FA.tmp 844 4277.tmp 2624 4304.tmp 2740 4381.tmp 2644 43FE.tmp 564 447B.tmp 432 4517.tmp 3284 45B4.tmp 2452 4640.tmp 512 46BD.tmp 2392 473A.tmp 2848 47A8.tmp 3856 4825.tmp 1424 48A2.tmp 5056 493E.tmp 728 49BB.tmp 3248 4A38.tmp 1948 4AD4.tmp 1036 4B41.tmp 2116 4BDE.tmp 4808 4C3B.tmp 4296 4CB8.tmp 4124 4D16.tmp 4260 4D93.tmp 552 4E10.tmp 4924 4E8D.tmp 5036 4F0A.tmp 4448 4F78.tmp 4616 4FF5.tmp 1080 5052.tmp 3312 50B0.tmp 2228 50FE.tmp 3164 515C.tmp 3100 51D9.tmp 4944 5237.tmp 1056 5294.tmp 4300 52E3.tmp 4608 5340.tmp 3616 539E.tmp 1140 53EC.tmp 2928 543A.tmp 2848 5498.tmp 4632 54E6.tmp 1708 5534.tmp 1256 5592.tmp 4364 55E0.tmp 1608 563E.tmp 4008 568C.tmp 3988 56DA.tmp 1528 5728.tmp 860 5786.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe39EC.tmp3AA7.tmp3B34.tmp3BC1.tmp3C7C.tmp3D28.tmp3DC4.tmp3E70.tmp3EED.tmp3F6A.tmp4035.tmp40B2.tmp414F.tmp41FA.tmp4277.tmp4304.tmp4381.tmp43FE.tmp447B.tmp4517.tmp45B4.tmpdescription pid process target process PID 836 wrote to memory of 2924 836 2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe 39EC.tmp PID 836 wrote to memory of 2924 836 2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe 39EC.tmp PID 836 wrote to memory of 2924 836 2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe 39EC.tmp PID 2924 wrote to memory of 5116 2924 39EC.tmp 3AA7.tmp PID 2924 wrote to memory of 5116 2924 39EC.tmp 3AA7.tmp PID 2924 wrote to memory of 5116 2924 39EC.tmp 3AA7.tmp PID 5116 wrote to memory of 4560 5116 3AA7.tmp 3B34.tmp PID 5116 wrote to memory of 4560 5116 3AA7.tmp 3B34.tmp PID 5116 wrote to memory of 4560 5116 3AA7.tmp 3B34.tmp PID 4560 wrote to memory of 4004 4560 3B34.tmp 3BC1.tmp PID 4560 wrote to memory of 4004 4560 3B34.tmp 3BC1.tmp PID 4560 wrote to memory of 4004 4560 3B34.tmp 3BC1.tmp PID 4004 wrote to memory of 2436 4004 3BC1.tmp 3C7C.tmp PID 4004 wrote to memory of 2436 4004 3BC1.tmp 3C7C.tmp PID 4004 wrote to memory of 2436 4004 3BC1.tmp 3C7C.tmp PID 2436 wrote to memory of 4808 2436 3C7C.tmp 3D28.tmp PID 2436 wrote to memory of 4808 2436 3C7C.tmp 3D28.tmp PID 2436 wrote to memory of 4808 2436 3C7C.tmp 3D28.tmp PID 4808 wrote to memory of 4172 4808 3D28.tmp 3DC4.tmp PID 4808 wrote to memory of 4172 4808 3D28.tmp 3DC4.tmp PID 4808 wrote to memory of 4172 4808 3D28.tmp 3DC4.tmp PID 4172 wrote to memory of 4432 4172 3DC4.tmp 3E70.tmp PID 4172 wrote to memory of 4432 4172 3DC4.tmp 3E70.tmp PID 4172 wrote to memory of 4432 4172 3DC4.tmp 3E70.tmp PID 4432 wrote to memory of 4032 4432 3E70.tmp 3EED.tmp PID 4432 wrote to memory of 4032 4432 3E70.tmp 3EED.tmp PID 4432 wrote to memory of 4032 4432 3E70.tmp 3EED.tmp PID 4032 wrote to memory of 448 4032 3EED.tmp 3F6A.tmp PID 4032 wrote to memory of 448 4032 3EED.tmp 3F6A.tmp PID 4032 wrote to memory of 448 4032 3EED.tmp 3F6A.tmp PID 448 wrote to memory of 4924 448 3F6A.tmp 4035.tmp PID 448 wrote to memory of 4924 448 3F6A.tmp 4035.tmp PID 448 wrote to memory of 4924 448 3F6A.tmp 4035.tmp PID 4924 wrote to memory of 5036 4924 4035.tmp 40B2.tmp PID 4924 wrote to memory of 5036 4924 4035.tmp 40B2.tmp PID 4924 wrote to memory of 5036 4924 4035.tmp 40B2.tmp PID 5036 wrote to memory of 1916 5036 40B2.tmp 414F.tmp PID 5036 wrote to memory of 1916 5036 40B2.tmp 414F.tmp PID 5036 wrote to memory of 1916 5036 40B2.tmp 414F.tmp PID 1916 wrote to memory of 1724 1916 414F.tmp 41FA.tmp PID 1916 wrote to memory of 1724 1916 414F.tmp 41FA.tmp PID 1916 wrote to memory of 1724 1916 414F.tmp 41FA.tmp PID 1724 wrote to memory of 844 1724 41FA.tmp 4277.tmp PID 1724 wrote to memory of 844 1724 41FA.tmp 4277.tmp PID 1724 wrote to memory of 844 1724 41FA.tmp 4277.tmp PID 844 wrote to memory of 2624 844 4277.tmp 4304.tmp PID 844 wrote to memory of 2624 844 4277.tmp 4304.tmp PID 844 wrote to memory of 2624 844 4277.tmp 4304.tmp PID 2624 wrote to memory of 2740 2624 4304.tmp 4381.tmp PID 2624 wrote to memory of 2740 2624 4304.tmp 4381.tmp PID 2624 wrote to memory of 2740 2624 4304.tmp 4381.tmp PID 2740 wrote to memory of 2644 2740 4381.tmp 43FE.tmp PID 2740 wrote to memory of 2644 2740 4381.tmp 43FE.tmp PID 2740 wrote to memory of 2644 2740 4381.tmp 43FE.tmp PID 2644 wrote to memory of 564 2644 43FE.tmp 447B.tmp PID 2644 wrote to memory of 564 2644 43FE.tmp 447B.tmp PID 2644 wrote to memory of 564 2644 43FE.tmp 447B.tmp PID 564 wrote to memory of 432 564 447B.tmp 4517.tmp PID 564 wrote to memory of 432 564 447B.tmp 4517.tmp PID 564 wrote to memory of 432 564 447B.tmp 4517.tmp PID 432 wrote to memory of 3284 432 4517.tmp 45B4.tmp PID 432 wrote to memory of 3284 432 4517.tmp 45B4.tmp PID 432 wrote to memory of 3284 432 4517.tmp 45B4.tmp PID 3284 wrote to memory of 2452 3284 45B4.tmp 4640.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_131092f5edf23fc56d7072c0a3fa68e4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Users\Admin\AppData\Local\Temp\39EC.tmp"C:\Users\Admin\AppData\Local\Temp\39EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"C:\Users\Admin\AppData\Local\Temp\3AA7.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\3B34.tmp"C:\Users\Admin\AppData\Local\Temp\3B34.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"C:\Users\Admin\AppData\Local\Temp\3BC1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\3D28.tmp"C:\Users\Admin\AppData\Local\Temp\3D28.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"C:\Users\Admin\AppData\Local\Temp\3DC4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\3E70.tmp"C:\Users\Admin\AppData\Local\Temp\3E70.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"C:\Users\Admin\AppData\Local\Temp\3F6A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\414F.tmp"C:\Users\Admin\AppData\Local\Temp\414F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\41FA.tmp"C:\Users\Admin\AppData\Local\Temp\41FA.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\4381.tmp"C:\Users\Admin\AppData\Local\Temp\4381.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\4640.tmp"C:\Users\Admin\AppData\Local\Temp\4640.tmp"23⤵
- Executes dropped EXE
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"24⤵
- Executes dropped EXE
PID:512 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"25⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"26⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"27⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"28⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"29⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"30⤵
- Executes dropped EXE
PID:728 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"31⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"32⤵
- Executes dropped EXE
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"33⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"C:\Users\Admin\AppData\Local\Temp\4BDE.tmp"34⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"C:\Users\Admin\AppData\Local\Temp\4C3B.tmp"35⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"36⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"37⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"38⤵
- Executes dropped EXE
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"39⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"40⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"41⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"42⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"43⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"44⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"45⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"46⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"47⤵
- Executes dropped EXE
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"48⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"49⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"50⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"51⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"52⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"53⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"54⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"55⤵
- Executes dropped EXE
PID:2928 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"56⤵
- Executes dropped EXE
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"57⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"58⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"59⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"60⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"61⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"62⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"63⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"64⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"65⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"66⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"67⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"68⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"69⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"70⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"71⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"72⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"73⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"74⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"75⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"76⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"77⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"78⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"79⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"80⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"81⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"82⤵PID:5020
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"83⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"84⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"85⤵PID:3928
-
C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"C:\Users\Admin\AppData\Local\Temp\5EBA.tmp"86⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"87⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"88⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"89⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"90⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"91⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"92⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"93⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\615A.tmp"C:\Users\Admin\AppData\Local\Temp\615A.tmp"94⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"95⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"96⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"97⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"98⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"99⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"100⤵PID:1528
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"101⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"102⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"103⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"104⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"105⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"106⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"107⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"108⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"109⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"110⤵PID:888
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"111⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"112⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"113⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"114⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"115⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"116⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"117⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"118⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"119⤵PID:3448
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"120⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"121⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"122⤵PID:3932
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-