Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 02:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe
-
Size
529KB
-
MD5
6cd693e754feca1bad449db92ae0bbdf
-
SHA1
8c5f033511ff02a8a13ba483c184fe29571501ad
-
SHA256
ffdbafd04838dd46041352e14bb6f14e59475d50aba3774e82056e7534a2a20f
-
SHA512
8a1dc9a60f4cbc3aaa39662d4f14533bb9480193f571cd7b6de2b8d9007eed9751af6891e52ce0e36a1cc617001e2a892e36a189232a353b72ca57b4ab0e8676
-
SSDEEP
12288:NU5rCOTeij/14Fmij9aaWrOD6pZcKqbyTZwlH4Hp:NUQOJjiFh+pLVTSlH4Hp
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 860 3FD8.tmp 2488 4074.tmp 3076 40E1.tmp 3120 416E.tmp 4636 41EB.tmp 1716 4268.tmp 3652 42E5.tmp 3404 4343.tmp 4744 43C0.tmp 4724 443D.tmp 3680 44BA.tmp 4180 4517.tmp 3044 4565.tmp 3344 45B4.tmp 1432 4621.tmp 1688 468E.tmp 1736 46FC.tmp 3128 4759.tmp 1184 47B7.tmp 944 4834.tmp 1636 48B1.tmp 3272 48FF.tmp 4916 495D.tmp 4152 49EA.tmp 1704 4A57.tmp 4676 4AB5.tmp 4604 4B32.tmp 4956 4B9F.tmp 2248 4C1C.tmp 2380 4C7A.tmp 4348 4CC8.tmp 1768 4D26.tmp 2944 4D93.tmp 2012 4DE1.tmp 1892 4E2F.tmp 3108 4E7E.tmp 2948 4ECC.tmp 1020 4F1A.tmp 1828 4F78.tmp 4960 4FC6.tmp 5044 5014.tmp 2272 5062.tmp 3516 50C0.tmp 2332 511D.tmp 4544 517B.tmp 3308 51C9.tmp 4984 5227.tmp 4912 5285.tmp 3888 52E3.tmp 4040 5331.tmp 3644 538E.tmp 4396 53DD.tmp 4588 542B.tmp 2404 5479.tmp 4516 54D7.tmp 764 5525.tmp 3088 5573.tmp 4784 55D1.tmp 924 561F.tmp 3016 567C.tmp 2912 56DA.tmp 2004 5738.tmp 2864 5796.tmp 3004 57E4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1048 wrote to memory of 860 1048 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 81 PID 1048 wrote to memory of 860 1048 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 81 PID 1048 wrote to memory of 860 1048 2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe 81 PID 860 wrote to memory of 2488 860 3FD8.tmp 82 PID 860 wrote to memory of 2488 860 3FD8.tmp 82 PID 860 wrote to memory of 2488 860 3FD8.tmp 82 PID 2488 wrote to memory of 3076 2488 4074.tmp 85 PID 2488 wrote to memory of 3076 2488 4074.tmp 85 PID 2488 wrote to memory of 3076 2488 4074.tmp 85 PID 3076 wrote to memory of 3120 3076 40E1.tmp 86 PID 3076 wrote to memory of 3120 3076 40E1.tmp 86 PID 3076 wrote to memory of 3120 3076 40E1.tmp 86 PID 3120 wrote to memory of 4636 3120 416E.tmp 88 PID 3120 wrote to memory of 4636 3120 416E.tmp 88 PID 3120 wrote to memory of 4636 3120 416E.tmp 88 PID 4636 wrote to memory of 1716 4636 41EB.tmp 89 PID 4636 wrote to memory of 1716 4636 41EB.tmp 89 PID 4636 wrote to memory of 1716 4636 41EB.tmp 89 PID 1716 wrote to memory of 3652 1716 4268.tmp 90 PID 1716 wrote to memory of 3652 1716 4268.tmp 90 PID 1716 wrote to memory of 3652 1716 4268.tmp 90 PID 3652 wrote to memory of 3404 3652 42E5.tmp 91 PID 3652 wrote to memory of 3404 3652 42E5.tmp 91 PID 3652 wrote to memory of 3404 3652 42E5.tmp 91 PID 3404 wrote to memory of 4744 3404 4343.tmp 92 PID 3404 wrote to memory of 4744 3404 4343.tmp 92 PID 3404 wrote to memory of 4744 3404 4343.tmp 92 PID 4744 wrote to memory of 4724 4744 43C0.tmp 93 PID 4744 wrote to memory of 4724 4744 43C0.tmp 93 PID 4744 wrote to memory of 4724 4744 43C0.tmp 93 PID 4724 wrote to memory of 3680 4724 443D.tmp 94 PID 4724 wrote to memory of 3680 4724 443D.tmp 94 PID 4724 wrote to memory of 3680 4724 443D.tmp 94 PID 3680 wrote to memory of 4180 3680 44BA.tmp 95 PID 3680 wrote to memory of 4180 3680 44BA.tmp 95 PID 3680 wrote to memory of 4180 3680 44BA.tmp 95 PID 4180 wrote to memory of 3044 4180 4517.tmp 96 PID 4180 wrote to memory of 3044 4180 4517.tmp 96 PID 4180 wrote to memory of 3044 4180 4517.tmp 96 PID 3044 wrote to memory of 3344 3044 4565.tmp 97 PID 3044 wrote to memory of 3344 3044 4565.tmp 97 PID 3044 wrote to memory of 3344 3044 4565.tmp 97 PID 3344 wrote to memory of 1432 3344 45B4.tmp 98 PID 3344 wrote to memory of 1432 3344 45B4.tmp 98 PID 3344 wrote to memory of 1432 3344 45B4.tmp 98 PID 1432 wrote to memory of 1688 1432 4621.tmp 99 PID 1432 wrote to memory of 1688 1432 4621.tmp 99 PID 1432 wrote to memory of 1688 1432 4621.tmp 99 PID 1688 wrote to memory of 1736 1688 468E.tmp 100 PID 1688 wrote to memory of 1736 1688 468E.tmp 100 PID 1688 wrote to memory of 1736 1688 468E.tmp 100 PID 1736 wrote to memory of 3128 1736 46FC.tmp 101 PID 1736 wrote to memory of 3128 1736 46FC.tmp 101 PID 1736 wrote to memory of 3128 1736 46FC.tmp 101 PID 3128 wrote to memory of 1184 3128 4759.tmp 102 PID 3128 wrote to memory of 1184 3128 4759.tmp 102 PID 3128 wrote to memory of 1184 3128 4759.tmp 102 PID 1184 wrote to memory of 944 1184 47B7.tmp 103 PID 1184 wrote to memory of 944 1184 47B7.tmp 103 PID 1184 wrote to memory of 944 1184 47B7.tmp 103 PID 944 wrote to memory of 1636 944 4834.tmp 104 PID 944 wrote to memory of 1636 944 4834.tmp 104 PID 944 wrote to memory of 1636 944 4834.tmp 104 PID 1636 wrote to memory of 3272 1636 48B1.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_6cd693e754feca1bad449db92ae0bbdf_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:860 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\416E.tmp"C:\Users\Admin\AppData\Local\Temp\416E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\41EB.tmp"C:\Users\Admin\AppData\Local\Temp\41EB.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\4268.tmp"C:\Users\Admin\AppData\Local\Temp\4268.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\4621.tmp"C:\Users\Admin\AppData\Local\Temp\4621.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4834.tmp"C:\Users\Admin\AppData\Local\Temp\4834.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\48FF.tmp"C:\Users\Admin\AppData\Local\Temp\48FF.tmp"23⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"24⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"25⤵
- Executes dropped EXE
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"26⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"27⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"28⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"29⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"30⤵
- Executes dropped EXE
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"31⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"32⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"33⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"34⤵
- Executes dropped EXE
PID:2944 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"35⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"36⤵
- Executes dropped EXE
PID:1892 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"37⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"38⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"39⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"40⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"41⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"42⤵
- Executes dropped EXE
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"43⤵
- Executes dropped EXE
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"44⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"45⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"46⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"47⤵
- Executes dropped EXE
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"48⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"49⤵
- Executes dropped EXE
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"50⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"51⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"52⤵
- Executes dropped EXE
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"53⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"54⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"55⤵
- Executes dropped EXE
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"56⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\5525.tmp"C:\Users\Admin\AppData\Local\Temp\5525.tmp"57⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"58⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"59⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"60⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"61⤵
- Executes dropped EXE
PID:3016 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"62⤵
- Executes dropped EXE
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"63⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\5796.tmp"C:\Users\Admin\AppData\Local\Temp\5796.tmp"64⤵
- Executes dropped EXE
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"65⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"66⤵PID:3180
-
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"68⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"69⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"70⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"71⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"72⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"73⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"C:\Users\Admin\AppData\Local\Temp\5AE1.tmp"74⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"75⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"76⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"77⤵PID:1740
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"78⤵PID:2416
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"79⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"80⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"81⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"82⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"83⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"84⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"85⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"86⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"87⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"88⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"89⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"90⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"91⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"92⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"93⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"94⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"95⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"96⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\62A2.tmp"C:\Users\Admin\AppData\Local\Temp\62A2.tmp"97⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"98⤵PID:372
-
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"99⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"100⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"101⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"102⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\64A5.tmp"C:\Users\Admin\AppData\Local\Temp\64A5.tmp"103⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"104⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"105⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"106⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"107⤵PID:4756
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"108⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"109⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"110⤵PID:4004
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"111⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"112⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"113⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"114⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"115⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"116⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"117⤵PID:3672
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"118⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"119⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"120⤵PID:1824
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"121⤵PID:4176
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"122⤵PID:3328
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-