Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe
-
Size
487KB
-
MD5
79dde8710c327cbcec31c8320089761b
-
SHA1
0313078b6016b8c313ba398e487b477b2ece5ee4
-
SHA256
cb78607c3d2cb67971a7b3b50dacb9f8486c02cac6c06d8f643b658a018c764b
-
SHA512
30547054deea11ac60902ed43398eecd02520d027741f55fdb4c461acd3d4cf14aef9838cbf9f3c2ebb53d40b7f1ce0c8361c111b31a46001212136add873488
-
SSDEEP
12288:yU5rCOTeiNUhCPb7oQWg4PBfSbOvw8hbZ:yUQOJNUkLcJLbb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
5081.tmp510E.tmp516C.tmp51D9.tmp5266.tmp52C3.tmp5331.tmp539E.tmp53FC.tmp545A.tmp54C7.tmp5554.tmp55A2.tmp55FF.tmp567C.tmp56EA.tmp5757.tmp57B5.tmp5813.tmp5870.tmp58DE.tmp595B.tmp59C8.tmp5A16.tmp5A84.tmp5B10.tmp5B8D.tmp5BFB.tmp5C68.tmp5CD5.tmp5D52.tmp5DCF.tmp5E4C.tmp5EE9.tmp5F37.tmp5F95.tmp5FE3.tmp6040.tmp609E.tmp60FC.tmp614A.tmp6198.tmp61E6.tmp6234.tmp6283.tmp62E0.tmp632E.tmp637D.tmp63CB.tmp6428.tmp6477.tmp64D4.tmp6532.tmp6580.tmp65DE.tmp663C.tmp668A.tmp66E8.tmp6736.tmp6784.tmp67D2.tmp6820.tmp686E.tmp68BC.tmppid process 1348 5081.tmp 3524 510E.tmp 1892 516C.tmp 2900 51D9.tmp 1436 5266.tmp 4476 52C3.tmp 2212 5331.tmp 4648 539E.tmp 4680 53FC.tmp 4920 545A.tmp 1920 54C7.tmp 1916 5554.tmp 4356 55A2.tmp 2396 55FF.tmp 4456 567C.tmp 5020 56EA.tmp 1160 5757.tmp 4268 57B5.tmp 3868 5813.tmp 4256 5870.tmp 3412 58DE.tmp 2008 595B.tmp 1708 59C8.tmp 1152 5A16.tmp 4452 5A84.tmp 2576 5B10.tmp 2768 5B8D.tmp 3960 5BFB.tmp 3600 5C68.tmp 4332 5CD5.tmp 5032 5D52.tmp 3148 5DCF.tmp 3612 5E4C.tmp 4640 5EE9.tmp 1788 5F37.tmp 2876 5F95.tmp 3640 5FE3.tmp 2656 6040.tmp 3024 609E.tmp 1528 60FC.tmp 3396 614A.tmp 1836 6198.tmp 3816 61E6.tmp 4088 6234.tmp 980 6283.tmp 4648 62E0.tmp 4492 632E.tmp 1028 637D.tmp 4920 63CB.tmp 2268 6428.tmp 824 6477.tmp 4608 64D4.tmp 5040 6532.tmp 2196 6580.tmp 3764 65DE.tmp 4908 663C.tmp 1668 668A.tmp 3204 66E8.tmp 3352 6736.tmp 4268 6784.tmp 3868 67D2.tmp 4416 6820.tmp 4484 686E.tmp 3684 68BC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe5081.tmp510E.tmp516C.tmp51D9.tmp5266.tmp52C3.tmp5331.tmp539E.tmp53FC.tmp545A.tmp54C7.tmp5554.tmp55A2.tmp55FF.tmp567C.tmp56EA.tmp5757.tmp57B5.tmp5813.tmp5870.tmp58DE.tmpdescription pid process target process PID 972 wrote to memory of 1348 972 2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe 5081.tmp PID 972 wrote to memory of 1348 972 2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe 5081.tmp PID 972 wrote to memory of 1348 972 2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe 5081.tmp PID 1348 wrote to memory of 3524 1348 5081.tmp 510E.tmp PID 1348 wrote to memory of 3524 1348 5081.tmp 510E.tmp PID 1348 wrote to memory of 3524 1348 5081.tmp 510E.tmp PID 3524 wrote to memory of 1892 3524 510E.tmp 516C.tmp PID 3524 wrote to memory of 1892 3524 510E.tmp 516C.tmp PID 3524 wrote to memory of 1892 3524 510E.tmp 516C.tmp PID 1892 wrote to memory of 2900 1892 516C.tmp 51D9.tmp PID 1892 wrote to memory of 2900 1892 516C.tmp 51D9.tmp PID 1892 wrote to memory of 2900 1892 516C.tmp 51D9.tmp PID 2900 wrote to memory of 1436 2900 51D9.tmp 5266.tmp PID 2900 wrote to memory of 1436 2900 51D9.tmp 5266.tmp PID 2900 wrote to memory of 1436 2900 51D9.tmp 5266.tmp PID 1436 wrote to memory of 4476 1436 5266.tmp 52C3.tmp PID 1436 wrote to memory of 4476 1436 5266.tmp 52C3.tmp PID 1436 wrote to memory of 4476 1436 5266.tmp 52C3.tmp PID 4476 wrote to memory of 2212 4476 52C3.tmp 5331.tmp PID 4476 wrote to memory of 2212 4476 52C3.tmp 5331.tmp PID 4476 wrote to memory of 2212 4476 52C3.tmp 5331.tmp PID 2212 wrote to memory of 4648 2212 5331.tmp 539E.tmp PID 2212 wrote to memory of 4648 2212 5331.tmp 539E.tmp PID 2212 wrote to memory of 4648 2212 5331.tmp 539E.tmp PID 4648 wrote to memory of 4680 4648 539E.tmp 53FC.tmp PID 4648 wrote to memory of 4680 4648 539E.tmp 53FC.tmp PID 4648 wrote to memory of 4680 4648 539E.tmp 53FC.tmp PID 4680 wrote to memory of 4920 4680 53FC.tmp 545A.tmp PID 4680 wrote to memory of 4920 4680 53FC.tmp 545A.tmp PID 4680 wrote to memory of 4920 4680 53FC.tmp 545A.tmp PID 4920 wrote to memory of 1920 4920 545A.tmp 54C7.tmp PID 4920 wrote to memory of 1920 4920 545A.tmp 54C7.tmp PID 4920 wrote to memory of 1920 4920 545A.tmp 54C7.tmp PID 1920 wrote to memory of 1916 1920 54C7.tmp 5554.tmp PID 1920 wrote to memory of 1916 1920 54C7.tmp 5554.tmp PID 1920 wrote to memory of 1916 1920 54C7.tmp 5554.tmp PID 1916 wrote to memory of 4356 1916 5554.tmp 55A2.tmp PID 1916 wrote to memory of 4356 1916 5554.tmp 55A2.tmp PID 1916 wrote to memory of 4356 1916 5554.tmp 55A2.tmp PID 4356 wrote to memory of 2396 4356 55A2.tmp 55FF.tmp PID 4356 wrote to memory of 2396 4356 55A2.tmp 55FF.tmp PID 4356 wrote to memory of 2396 4356 55A2.tmp 55FF.tmp PID 2396 wrote to memory of 4456 2396 55FF.tmp 567C.tmp PID 2396 wrote to memory of 4456 2396 55FF.tmp 567C.tmp PID 2396 wrote to memory of 4456 2396 55FF.tmp 567C.tmp PID 4456 wrote to memory of 5020 4456 567C.tmp 56EA.tmp PID 4456 wrote to memory of 5020 4456 567C.tmp 56EA.tmp PID 4456 wrote to memory of 5020 4456 567C.tmp 56EA.tmp PID 5020 wrote to memory of 1160 5020 56EA.tmp 5757.tmp PID 5020 wrote to memory of 1160 5020 56EA.tmp 5757.tmp PID 5020 wrote to memory of 1160 5020 56EA.tmp 5757.tmp PID 1160 wrote to memory of 4268 1160 5757.tmp 57B5.tmp PID 1160 wrote to memory of 4268 1160 5757.tmp 57B5.tmp PID 1160 wrote to memory of 4268 1160 5757.tmp 57B5.tmp PID 4268 wrote to memory of 3868 4268 57B5.tmp 5813.tmp PID 4268 wrote to memory of 3868 4268 57B5.tmp 5813.tmp PID 4268 wrote to memory of 3868 4268 57B5.tmp 5813.tmp PID 3868 wrote to memory of 4256 3868 5813.tmp 5870.tmp PID 3868 wrote to memory of 4256 3868 5813.tmp 5870.tmp PID 3868 wrote to memory of 4256 3868 5813.tmp 5870.tmp PID 4256 wrote to memory of 3412 4256 5870.tmp 58DE.tmp PID 4256 wrote to memory of 3412 4256 5870.tmp 58DE.tmp PID 4256 wrote to memory of 3412 4256 5870.tmp 58DE.tmp PID 3412 wrote to memory of 2008 3412 58DE.tmp 595B.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_79dde8710c327cbcec31c8320089761b_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:972 -
C:\Users\Admin\AppData\Local\Temp\5081.tmp"C:\Users\Admin\AppData\Local\Temp\5081.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\5554.tmp"C:\Users\Admin\AppData\Local\Temp\5554.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"23⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"24⤵
- Executes dropped EXE
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"25⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"26⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"27⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"28⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"29⤵
- Executes dropped EXE
PID:3960 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"30⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"31⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"32⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"33⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"34⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"35⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"36⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"37⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"38⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"39⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"40⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"41⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\60FC.tmp"C:\Users\Admin\AppData\Local\Temp\60FC.tmp"42⤵
- Executes dropped EXE
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"43⤵
- Executes dropped EXE
PID:3396 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"44⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"45⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"46⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"47⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"48⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"49⤵
- Executes dropped EXE
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"50⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"51⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"52⤵
- Executes dropped EXE
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"53⤵
- Executes dropped EXE
PID:824 -
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"54⤵
- Executes dropped EXE
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"55⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"56⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"57⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"58⤵
- Executes dropped EXE
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"59⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"60⤵
- Executes dropped EXE
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"61⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"62⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"63⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"64⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"65⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"66⤵
- Executes dropped EXE
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"67⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"68⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"69⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"70⤵PID:2300
-
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"71⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"72⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"73⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"74⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"75⤵PID:2768
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"76⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"77⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"78⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"79⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"80⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"81⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"82⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"83⤵PID:1832
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"85⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"86⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\703E.tmp"C:\Users\Admin\AppData\Local\Temp\703E.tmp"87⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\708C.tmp"C:\Users\Admin\AppData\Local\Temp\708C.tmp"88⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"89⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\7148.tmp"C:\Users\Admin\AppData\Local\Temp\7148.tmp"90⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\7196.tmp"C:\Users\Admin\AppData\Local\Temp\7196.tmp"91⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\71E4.tmp"C:\Users\Admin\AppData\Local\Temp\71E4.tmp"92⤵PID:4276
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"93⤵PID:3272
-
C:\Users\Admin\AppData\Local\Temp\72A0.tmp"C:\Users\Admin\AppData\Local\Temp\72A0.tmp"94⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\72FD.tmp"C:\Users\Admin\AppData\Local\Temp\72FD.tmp"95⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"96⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"97⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\7417.tmp"C:\Users\Admin\AppData\Local\Temp\7417.tmp"98⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\7474.tmp"C:\Users\Admin\AppData\Local\Temp\7474.tmp"99⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"100⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\758E.tmp"C:\Users\Admin\AppData\Local\Temp\758E.tmp"102⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\75EB.tmp"C:\Users\Admin\AppData\Local\Temp\75EB.tmp"103⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\7649.tmp"C:\Users\Admin\AppData\Local\Temp\7649.tmp"104⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\76A7.tmp"C:\Users\Admin\AppData\Local\Temp\76A7.tmp"105⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"106⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\7753.tmp"C:\Users\Admin\AppData\Local\Temp\7753.tmp"107⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"108⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"109⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"110⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"111⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"112⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\7976.tmp"C:\Users\Admin\AppData\Local\Temp\7976.tmp"113⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"114⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"115⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"116⤵PID:3984
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"117⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"118⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\7B79.tmp"C:\Users\Admin\AppData\Local\Temp\7B79.tmp"119⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"120⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\7C15.tmp"C:\Users\Admin\AppData\Local\Temp\7C15.tmp"121⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\7C64.tmp"C:\Users\Admin\AppData\Local\Temp\7C64.tmp"122⤵PID:2040
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-