Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 20:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe
-
Size
541KB
-
MD5
13b0d581bd34d2ef408830f8437ab053
-
SHA1
c8fc6d84eee2ff27de42d7d8dcdfc8a693c7dd86
-
SHA256
5dcc4124d12bf058bde7b5cfbc2f8eb2a6dac80fe2632b5437289f0dd4a7e309
-
SHA512
bb9863b443eb9beedc37e45fc9d328462b11748a06dc3359d1f54293bb2fce44bfdea2d47d619e7810fc9a531f4074a1da7785a83f3c9323df4efc961a49d893
-
SSDEEP
12288:UU5rCOTeifj5dnXQ8QuTWCpA6+2aGdjTh7FntNPrZa73ctO:UUQOJfjzXQnvCpL+QdjTh7ZPrU73ctO
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
46DC.tmp4798.tmp4815.tmp48B1.tmp490F.tmp496D.tmp49EA.tmp4A67.tmp4AC4.tmp4B41.tmp4B9F.tmp4C1C.tmp4C8A.tmp4D16.tmp4DB2.tmp4E01.tmp4E8D.tmp4EFB.tmp4F68.tmp5004.tmp50A0.tmp512D.tmp518B.tmp51E9.tmp5266.tmp52C3.tmp5350.tmp539E.tmp542B.tmp5498.tmp5505.tmp5582.tmp560F.tmp568C.tmp56DA.tmp5728.tmp5786.tmp57D4.tmp5832.tmp5890.tmp58DE.tmp593C.tmp59B9.tmp5A16.tmp5A74.tmp5AD2.tmp5B30.tmp5B8D.tmp5BEB.tmp5C49.tmp5CA7.tmp5CF5.tmp5D62.tmp5DCF.tmp5E2D.tmp5E7B.tmp5EC9.tmp5F27.tmp5F85.tmp5FE3.tmp6040.tmp609E.tmp60EC.tmp614A.tmppid process 756 46DC.tmp 3712 4798.tmp 508 4815.tmp 4716 48B1.tmp 4612 490F.tmp 2456 496D.tmp 3648 49EA.tmp 2804 4A67.tmp 436 4AC4.tmp 320 4B41.tmp 2672 4B9F.tmp 1148 4C1C.tmp 4708 4C8A.tmp 4740 4D16.tmp 1708 4DB2.tmp 4644 4E01.tmp 3172 4E8D.tmp 1196 4EFB.tmp 4768 4F68.tmp 4248 5004.tmp 3012 50A0.tmp 3752 512D.tmp 2028 518B.tmp 2244 51E9.tmp 2016 5266.tmp 2164 52C3.tmp 4492 5350.tmp 4176 539E.tmp 4536 542B.tmp 4232 5498.tmp 2404 5505.tmp 3628 5582.tmp 4760 560F.tmp 1140 568C.tmp 116 56DA.tmp 972 5728.tmp 3996 5786.tmp 4360 57D4.tmp 3480 5832.tmp 3988 5890.tmp 4848 58DE.tmp 1304 593C.tmp 1644 59B9.tmp 264 5A16.tmp 2308 5A74.tmp 4700 5AD2.tmp 3900 5B30.tmp 3436 5B8D.tmp 3216 5BEB.tmp 1148 5C49.tmp 4048 5CA7.tmp 3832 5CF5.tmp 768 5D62.tmp 1708 5DCF.tmp 5048 5E2D.tmp 1844 5E7B.tmp 1648 5EC9.tmp 1236 5F27.tmp 3292 5F85.tmp 4996 5FE3.tmp 1244 6040.tmp 4856 609E.tmp 2376 60EC.tmp 1616 614A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe46DC.tmp4798.tmp4815.tmp48B1.tmp490F.tmp496D.tmp49EA.tmp4A67.tmp4AC4.tmp4B41.tmp4B9F.tmp4C1C.tmp4C8A.tmp4D16.tmp4DB2.tmp4E01.tmp4E8D.tmp4EFB.tmp4F68.tmp5004.tmp50A0.tmpdescription pid process target process PID 3480 wrote to memory of 756 3480 2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe 46DC.tmp PID 3480 wrote to memory of 756 3480 2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe 46DC.tmp PID 3480 wrote to memory of 756 3480 2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe 46DC.tmp PID 756 wrote to memory of 3712 756 46DC.tmp 4798.tmp PID 756 wrote to memory of 3712 756 46DC.tmp 4798.tmp PID 756 wrote to memory of 3712 756 46DC.tmp 4798.tmp PID 3712 wrote to memory of 508 3712 4798.tmp 4815.tmp PID 3712 wrote to memory of 508 3712 4798.tmp 4815.tmp PID 3712 wrote to memory of 508 3712 4798.tmp 4815.tmp PID 508 wrote to memory of 4716 508 4815.tmp 48B1.tmp PID 508 wrote to memory of 4716 508 4815.tmp 48B1.tmp PID 508 wrote to memory of 4716 508 4815.tmp 48B1.tmp PID 4716 wrote to memory of 4612 4716 48B1.tmp 490F.tmp PID 4716 wrote to memory of 4612 4716 48B1.tmp 490F.tmp PID 4716 wrote to memory of 4612 4716 48B1.tmp 490F.tmp PID 4612 wrote to memory of 2456 4612 490F.tmp 496D.tmp PID 4612 wrote to memory of 2456 4612 490F.tmp 496D.tmp PID 4612 wrote to memory of 2456 4612 490F.tmp 496D.tmp PID 2456 wrote to memory of 3648 2456 496D.tmp 49EA.tmp PID 2456 wrote to memory of 3648 2456 496D.tmp 49EA.tmp PID 2456 wrote to memory of 3648 2456 496D.tmp 49EA.tmp PID 3648 wrote to memory of 2804 3648 49EA.tmp 4A67.tmp PID 3648 wrote to memory of 2804 3648 49EA.tmp 4A67.tmp PID 3648 wrote to memory of 2804 3648 49EA.tmp 4A67.tmp PID 2804 wrote to memory of 436 2804 4A67.tmp 4AC4.tmp PID 2804 wrote to memory of 436 2804 4A67.tmp 4AC4.tmp PID 2804 wrote to memory of 436 2804 4A67.tmp 4AC4.tmp PID 436 wrote to memory of 320 436 4AC4.tmp 4B41.tmp PID 436 wrote to memory of 320 436 4AC4.tmp 4B41.tmp PID 436 wrote to memory of 320 436 4AC4.tmp 4B41.tmp PID 320 wrote to memory of 2672 320 4B41.tmp 4B9F.tmp PID 320 wrote to memory of 2672 320 4B41.tmp 4B9F.tmp PID 320 wrote to memory of 2672 320 4B41.tmp 4B9F.tmp PID 2672 wrote to memory of 1148 2672 4B9F.tmp 4C1C.tmp PID 2672 wrote to memory of 1148 2672 4B9F.tmp 4C1C.tmp PID 2672 wrote to memory of 1148 2672 4B9F.tmp 4C1C.tmp PID 1148 wrote to memory of 4708 1148 4C1C.tmp 4C8A.tmp PID 1148 wrote to memory of 4708 1148 4C1C.tmp 4C8A.tmp PID 1148 wrote to memory of 4708 1148 4C1C.tmp 4C8A.tmp PID 4708 wrote to memory of 4740 4708 4C8A.tmp 4D16.tmp PID 4708 wrote to memory of 4740 4708 4C8A.tmp 4D16.tmp PID 4708 wrote to memory of 4740 4708 4C8A.tmp 4D16.tmp PID 4740 wrote to memory of 1708 4740 4D16.tmp 4DB2.tmp PID 4740 wrote to memory of 1708 4740 4D16.tmp 4DB2.tmp PID 4740 wrote to memory of 1708 4740 4D16.tmp 4DB2.tmp PID 1708 wrote to memory of 4644 1708 4DB2.tmp 4E01.tmp PID 1708 wrote to memory of 4644 1708 4DB2.tmp 4E01.tmp PID 1708 wrote to memory of 4644 1708 4DB2.tmp 4E01.tmp PID 4644 wrote to memory of 3172 4644 4E01.tmp 4E8D.tmp PID 4644 wrote to memory of 3172 4644 4E01.tmp 4E8D.tmp PID 4644 wrote to memory of 3172 4644 4E01.tmp 4E8D.tmp PID 3172 wrote to memory of 1196 3172 4E8D.tmp 4EFB.tmp PID 3172 wrote to memory of 1196 3172 4E8D.tmp 4EFB.tmp PID 3172 wrote to memory of 1196 3172 4E8D.tmp 4EFB.tmp PID 1196 wrote to memory of 4768 1196 4EFB.tmp 4F68.tmp PID 1196 wrote to memory of 4768 1196 4EFB.tmp 4F68.tmp PID 1196 wrote to memory of 4768 1196 4EFB.tmp 4F68.tmp PID 4768 wrote to memory of 4248 4768 4F68.tmp 5004.tmp PID 4768 wrote to memory of 4248 4768 4F68.tmp 5004.tmp PID 4768 wrote to memory of 4248 4768 4F68.tmp 5004.tmp PID 4248 wrote to memory of 3012 4248 5004.tmp 50A0.tmp PID 4248 wrote to memory of 3012 4248 5004.tmp 50A0.tmp PID 4248 wrote to memory of 3012 4248 5004.tmp 50A0.tmp PID 3012 wrote to memory of 3752 3012 50A0.tmp 512D.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_13b0d581bd34d2ef408830f8437ab053_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3648 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"23⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"24⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"25⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"26⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"27⤵
- Executes dropped EXE
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"28⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"29⤵
- Executes dropped EXE
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"30⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"31⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"32⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"33⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"34⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"35⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"36⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"37⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"38⤵
- Executes dropped EXE
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"39⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"40⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"41⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"42⤵
- Executes dropped EXE
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"43⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"44⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"45⤵
- Executes dropped EXE
PID:264 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"46⤵
- Executes dropped EXE
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"47⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"48⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"49⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"50⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"51⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"C:\Users\Admin\AppData\Local\Temp\5CA7.tmp"52⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"53⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"54⤵
- Executes dropped EXE
PID:768 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"55⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"56⤵
- Executes dropped EXE
PID:5048 -
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"57⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"58⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"59⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"60⤵
- Executes dropped EXE
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"61⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"62⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"63⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"64⤵
- Executes dropped EXE
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"65⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"66⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"67⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"68⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"69⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"70⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"71⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"72⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"73⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"74⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"75⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"76⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"77⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"78⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"79⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"80⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"81⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"82⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"83⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"84⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"85⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"86⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"87⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"88⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"89⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"90⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"91⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"C:\Users\Admin\AppData\Local\Temp\6AEF.tmp"92⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"93⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"94⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"95⤵PID:436
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"96⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"97⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"98⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"99⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"100⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"101⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"102⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"103⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"104⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"105⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"106⤵PID:836
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"107⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"108⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"109⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"110⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"111⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"112⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\7261.tmp"C:\Users\Admin\AppData\Local\Temp\7261.tmp"113⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"114⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"115⤵PID:4596
-
C:\Users\Admin\AppData\Local\Temp\736B.tmp"C:\Users\Admin\AppData\Local\Temp\736B.tmp"116⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"117⤵PID:2108
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"118⤵PID:4588
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"119⤵PID:376
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"120⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"121⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"122⤵PID:3564
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-