Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
03/06/2024, 20:13
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe
-
Size
488KB
-
MD5
d345f46a1c00b640492849cfbc9e6007
-
SHA1
c0b0e49a249cc0c0fb9827579b440a9352f2e2f5
-
SHA256
c4da546d8f1596b52864a9380436408640d752ae02b3fdd27d423f50413a0c7a
-
SHA512
3811f80555a903bf04191cfe585215bf895b582147cd86d7e4efa4c8ea8a4d6d45cf417e75cfd326edf3d33cadd01915973c2d3b4f3a620e3d8f67cfa60cf9dc
-
SSDEEP
12288:/U5rCOTeiDxlKZKpzC0c923ZD7aBprO14NZ:/UQOJDxlKYFsOaN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1852 4352.tmp 4396 43EE.tmp 4748 444C.tmp 1924 44BA.tmp 2892 4546.tmp 4140 45B4.tmp 1252 4631.tmp 4880 468E.tmp 1064 46FC.tmp 3352 4759.tmp 2452 4805.tmp 5096 4863.tmp 3628 48D0.tmp 2220 493E.tmp 4120 49AB.tmp 2524 4A47.tmp 3832 4AB5.tmp 4760 4B13.tmp 2216 4B9F.tmp 3624 4C2C.tmp 2896 4CA9.tmp 3000 4D16.tmp 3280 4D93.tmp 1476 4DF1.tmp 3152 4E7E.tmp 4332 4EDB.tmp 2056 4F68.tmp 4988 4FC6.tmp 2016 5033.tmp 4860 50B0.tmp 1860 510E.tmp 312 51AA.tmp 5036 5217.tmp 4344 5266.tmp 3924 52B4.tmp 1180 5302.tmp 3172 536F.tmp 3400 53DD.tmp 4592 543A.tmp 4428 54B7.tmp 4140 5525.tmp 560 5592.tmp 2988 55F0.tmp 2000 566D.tmp 4212 56DA.tmp 1020 5738.tmp 1596 5796.tmp 1172 57E4.tmp 4932 5851.tmp 4500 589F.tmp 3856 58FD.tmp 4584 595B.tmp 4376 59B9.tmp 3904 5A26.tmp 2232 5A93.tmp 3528 5AF1.tmp 880 5B4F.tmp 1688 5BBC.tmp 548 5C2A.tmp 5068 5C87.tmp 4636 5CF5.tmp 2504 5D52.tmp 4868 5DC0.tmp 3000 5E2D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4840 wrote to memory of 1852 4840 2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe 82 PID 4840 wrote to memory of 1852 4840 2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe 82 PID 4840 wrote to memory of 1852 4840 2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe 82 PID 1852 wrote to memory of 4396 1852 4352.tmp 83 PID 1852 wrote to memory of 4396 1852 4352.tmp 83 PID 1852 wrote to memory of 4396 1852 4352.tmp 83 PID 4396 wrote to memory of 4748 4396 43EE.tmp 84 PID 4396 wrote to memory of 4748 4396 43EE.tmp 84 PID 4396 wrote to memory of 4748 4396 43EE.tmp 84 PID 4748 wrote to memory of 1924 4748 444C.tmp 85 PID 4748 wrote to memory of 1924 4748 444C.tmp 85 PID 4748 wrote to memory of 1924 4748 444C.tmp 85 PID 1924 wrote to memory of 2892 1924 44BA.tmp 86 PID 1924 wrote to memory of 2892 1924 44BA.tmp 86 PID 1924 wrote to memory of 2892 1924 44BA.tmp 86 PID 2892 wrote to memory of 4140 2892 4546.tmp 88 PID 2892 wrote to memory of 4140 2892 4546.tmp 88 PID 2892 wrote to memory of 4140 2892 4546.tmp 88 PID 4140 wrote to memory of 1252 4140 45B4.tmp 89 PID 4140 wrote to memory of 1252 4140 45B4.tmp 89 PID 4140 wrote to memory of 1252 4140 45B4.tmp 89 PID 1252 wrote to memory of 4880 1252 4631.tmp 91 PID 1252 wrote to memory of 4880 1252 4631.tmp 91 PID 1252 wrote to memory of 4880 1252 4631.tmp 91 PID 4880 wrote to memory of 1064 4880 468E.tmp 92 PID 4880 wrote to memory of 1064 4880 468E.tmp 92 PID 4880 wrote to memory of 1064 4880 468E.tmp 92 PID 1064 wrote to memory of 3352 1064 46FC.tmp 93 PID 1064 wrote to memory of 3352 1064 46FC.tmp 93 PID 1064 wrote to memory of 3352 1064 46FC.tmp 93 PID 3352 wrote to memory of 2452 3352 4759.tmp 95 PID 3352 wrote to memory of 2452 3352 4759.tmp 95 PID 3352 wrote to memory of 2452 3352 4759.tmp 95 PID 2452 wrote to memory of 5096 2452 4805.tmp 96 PID 2452 wrote to memory of 5096 2452 4805.tmp 96 PID 2452 wrote to memory of 5096 2452 4805.tmp 96 PID 5096 wrote to memory of 3628 5096 4863.tmp 97 PID 5096 wrote to memory of 3628 5096 4863.tmp 97 PID 5096 wrote to memory of 3628 5096 4863.tmp 97 PID 3628 wrote to memory of 2220 3628 48D0.tmp 98 PID 3628 wrote to memory of 2220 3628 48D0.tmp 98 PID 3628 wrote to memory of 2220 3628 48D0.tmp 98 PID 2220 wrote to memory of 4120 2220 493E.tmp 99 PID 2220 wrote to memory of 4120 2220 493E.tmp 99 PID 2220 wrote to memory of 4120 2220 493E.tmp 99 PID 4120 wrote to memory of 2524 4120 49AB.tmp 100 PID 4120 wrote to memory of 2524 4120 49AB.tmp 100 PID 4120 wrote to memory of 2524 4120 49AB.tmp 100 PID 2524 wrote to memory of 3832 2524 4A47.tmp 101 PID 2524 wrote to memory of 3832 2524 4A47.tmp 101 PID 2524 wrote to memory of 3832 2524 4A47.tmp 101 PID 3832 wrote to memory of 4760 3832 4AB5.tmp 102 PID 3832 wrote to memory of 4760 3832 4AB5.tmp 102 PID 3832 wrote to memory of 4760 3832 4AB5.tmp 102 PID 4760 wrote to memory of 2216 4760 4B13.tmp 103 PID 4760 wrote to memory of 2216 4760 4B13.tmp 103 PID 4760 wrote to memory of 2216 4760 4B13.tmp 103 PID 2216 wrote to memory of 3624 2216 4B9F.tmp 104 PID 2216 wrote to memory of 3624 2216 4B9F.tmp 104 PID 2216 wrote to memory of 3624 2216 4B9F.tmp 104 PID 3624 wrote to memory of 2896 3624 4C2C.tmp 105 PID 3624 wrote to memory of 2896 3624 4C2C.tmp 105 PID 3624 wrote to memory of 2896 3624 4C2C.tmp 105 PID 2896 wrote to memory of 3000 2896 4CA9.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_d345f46a1c00b640492849cfbc9e6007_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"23⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"24⤵
- Executes dropped EXE
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"C:\Users\Admin\AppData\Local\Temp\4DF1.tmp"25⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"26⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"27⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"28⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"29⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\5033.tmp"C:\Users\Admin\AppData\Local\Temp\5033.tmp"30⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"31⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"32⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"33⤵
- Executes dropped EXE
PID:312 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"34⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"35⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"36⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"37⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"38⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"39⤵
- Executes dropped EXE
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"40⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"41⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"42⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"43⤵
- Executes dropped EXE
PID:560 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"44⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"45⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"46⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"47⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"48⤵
- Executes dropped EXE
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"49⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"50⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"51⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"52⤵
- Executes dropped EXE
PID:3856 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"53⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"54⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"55⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"56⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"57⤵
- Executes dropped EXE
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"58⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"59⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"60⤵
- Executes dropped EXE
PID:548 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"61⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"62⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\5D52.tmp"C:\Users\Admin\AppData\Local\Temp\5D52.tmp"63⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"64⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"65⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"66⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"67⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"68⤵PID:1796
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"69⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"70⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"71⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"72⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"73⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"74⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"75⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"76⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"77⤵PID:1056
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"78⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"79⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"80⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"81⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"82⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"83⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"84⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\666B.tmp"C:\Users\Admin\AppData\Local\Temp\666B.tmp"85⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"86⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"87⤵PID:3400
-
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"88⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"89⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"90⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"91⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"92⤵PID:2988
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"93⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"94⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"95⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"96⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"97⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"98⤵PID:5076
-
C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"C:\Users\Admin\AppData\Local\Temp\6BCA.tmp"99⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"100⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"101⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"102⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"103⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"104⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"105⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\6E79.tmp"C:\Users\Admin\AppData\Local\Temp\6E79.tmp"106⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"C:\Users\Admin\AppData\Local\Temp\6ED7.tmp"107⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"108⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"109⤵PID:740
-
C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"C:\Users\Admin\AppData\Local\Temp\6FF0.tmp"110⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"111⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\709C.tmp"C:\Users\Admin\AppData\Local\Temp\709C.tmp"112⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"113⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"114⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\71B5.tmp"C:\Users\Admin\AppData\Local\Temp\71B5.tmp"115⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\7203.tmp"C:\Users\Admin\AppData\Local\Temp\7203.tmp"116⤵PID:612
-
C:\Users\Admin\AppData\Local\Temp\7251.tmp"C:\Users\Admin\AppData\Local\Temp\7251.tmp"117⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"118⤵PID:4704
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"119⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"120⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\73B9.tmp"C:\Users\Admin\AppData\Local\Temp\73B9.tmp"121⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"122⤵PID:3500
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-