Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 05:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe
- Size 487KB
- Sample240613-gh1krswerf
- SHA256 244bc8ff56981341efb5df85a96dc5b44f525ba957eb35a7b890411fcf8ba882
- MD5 46704c960d74d06a77917eef472966f5
- SHA1 c42fa8de56ec82ae3e3f16f91e92a6d7885536e7
- SHA512 8536f81b5bbbb84773efcd90c2ad89d13d9151d12fd0dfe5a73953b1f444f2e9f1679fa1639e4a928290e400785e734afb08afa84f4199a071689e8cd39c5469
- SSDEEP 6144:zorf3lPvovsgZnqG2C7mOTeiLxDxBoTvdvP63qUB/bATtKvvm3GctvxDQ7VSdsHt:yU5rCOTeiNLozNu1/sTtKnghyEybZ
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2112 55B1.tmp 224 562E.tmp 4124 56BB.tmp 2848 5748.tmp 4592 57C5.tmp 1124 5822.tmp 1824 5870.tmp 4992 58DE.tmp 4044 595B.tmp 2860 59A9.tmp 4520 59F7.tmp 3404 5A45.tmp 2068 5AA3.tmp 2764 5AF1.tmp 4132 5B5E.tmp 1604 5BDB.tmp 3372 5C49.tmp 1152 5C97.tmp 3488 5D14.tmp 688 5D72.tmp 1852 5DCF.tmp 4552 5E1E.tmp 2472 5E9B.tmp 1408 5EE9.tmp 3376 5F56.tmp 1296 5FA4.tmp 3216 5FF2.tmp 3140 6040.tmp 876 60AE.tmp 1340 610C.tmp 4984 6179.tmp 2312 61D7.tmp 4896 6244.tmp 4692 6292.tmp 1872 62D1.tmp 1704 631F.tmp 3700 635D.tmp 3436 63BB.tmp 1668 6409.tmp 1928 6467.tmp 3756 64C5.tmp 2372 6503.tmp 4616 6561.tmp 5052 65BF.tmp 4564 660D.tmp 3276 665B.tmp 4232 66B9.tmp 2180 6707.tmp 4544 6765.tmp 4312 67C2.tmp 1136 6820.tmp 4876 686E.tmp 1192 68BC.tmp 4684 692A.tmp 3252 6978.tmp 3360 69D6.tmp 852 6A24.tmp 4124 6A72.tmp 2540 6AC0.tmp 3152 6B0E.tmp 1624 6B6C.tmp 3344 6BBA.tmp 4456 6C08.tmp 4624 6C47.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4808 wrote to memory of 2112 4808 2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe 83 PID 4808 wrote to memory of 2112 4808 2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe 83 PID 4808 wrote to memory of 2112 4808 2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe 83 PID 2112 wrote to memory of 224 2112 55B1.tmp 85 PID 2112 wrote to memory of 224 2112 55B1.tmp 85 PID 2112 wrote to memory of 224 2112 55B1.tmp 85 PID 224 wrote to memory of 4124 224 562E.tmp 86 PID 224 wrote to memory of 4124 224 562E.tmp 86 PID 224 wrote to memory of 4124 224 562E.tmp 86 PID 4124 wrote to memory of 2848 4124 56BB.tmp 88 PID 4124 wrote to memory of 2848 4124 56BB.tmp 88 PID 4124 wrote to memory of 2848 4124 56BB.tmp 88 PID 2848 wrote to memory of 4592 2848 5748.tmp 89 PID 2848 wrote to memory of 4592 2848 5748.tmp 89 PID 2848 wrote to memory of 4592 2848 5748.tmp 89 PID 4592 wrote to memory of 1124 4592 57C5.tmp 90 PID 4592 wrote to memory of 1124 4592 57C5.tmp 90 PID 4592 wrote to memory of 1124 4592 57C5.tmp 90 PID 1124 wrote to memory of 1824 1124 5822.tmp 91 PID 1124 wrote to memory of 1824 1124 5822.tmp 91 PID 1124 wrote to memory of 1824 1124 5822.tmp 91 PID 1824 wrote to memory of 4992 1824 5870.tmp 92 PID 1824 wrote to memory of 4992 1824 5870.tmp 92 PID 1824 wrote to memory of 4992 1824 5870.tmp 92 PID 4992 wrote to memory of 4044 4992 58DE.tmp 93 PID 4992 wrote to memory of 4044 4992 58DE.tmp 93 PID 4992 wrote to memory of 4044 4992 58DE.tmp 93 PID 4044 wrote to memory of 2860 4044 595B.tmp 94 PID 4044 wrote to memory of 2860 4044 595B.tmp 94 PID 4044 wrote to memory of 2860 4044 595B.tmp 94 PID 2860 wrote to memory of 4520 2860 59A9.tmp 95 PID 2860 wrote to memory of 4520 2860 59A9.tmp 95 PID 2860 wrote to memory of 4520 2860 59A9.tmp 95 PID 4520 wrote to memory of 3404 4520 59F7.tmp 96 PID 4520 wrote to memory of 3404 4520 59F7.tmp 96 PID 4520 wrote to memory of 3404 4520 59F7.tmp 96 PID 3404 wrote to memory of 2068 3404 5A45.tmp 97 PID 3404 wrote to memory of 2068 3404 5A45.tmp 97 PID 3404 wrote to memory of 2068 3404 5A45.tmp 97 PID 2068 wrote to memory of 2764 2068 5AA3.tmp 98 PID 2068 wrote to memory of 2764 2068 5AA3.tmp 98 PID 2068 wrote to memory of 2764 2068 5AA3.tmp 98 PID 2764 wrote to memory of 4132 2764 5AF1.tmp 99 PID 2764 wrote to memory of 4132 2764 5AF1.tmp 99 PID 2764 wrote to memory of 4132 2764 5AF1.tmp 99 PID 4132 wrote to memory of 1604 4132 5B5E.tmp 100 PID 4132 wrote to memory of 1604 4132 5B5E.tmp 100 PID 4132 wrote to memory of 1604 4132 5B5E.tmp 100 PID 1604 wrote to memory of 3372 1604 5BDB.tmp 101 PID 1604 wrote to memory of 3372 1604 5BDB.tmp 101 PID 1604 wrote to memory of 3372 1604 5BDB.tmp 101 PID 3372 wrote to memory of 1152 3372 5C49.tmp 102 PID 3372 wrote to memory of 1152 3372 5C49.tmp 102 PID 3372 wrote to memory of 1152 3372 5C49.tmp 102 PID 1152 wrote to memory of 3488 1152 5C97.tmp 104 PID 1152 wrote to memory of 3488 1152 5C97.tmp 104 PID 1152 wrote to memory of 3488 1152 5C97.tmp 104 PID 3488 wrote to memory of 688 3488 5D14.tmp 105 PID 3488 wrote to memory of 688 3488 5D14.tmp 105 PID 3488 wrote to memory of 688 3488 5D14.tmp 105 PID 688 wrote to memory of 1852 688 5D72.tmp 106 PID 688 wrote to memory of 1852 688 5D72.tmp 106 PID 688 wrote to memory of 1852 688 5D72.tmp 106 PID 1852 wrote to memory of 4552 1852 5DCF.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_46704c960d74d06a77917eef472966f5_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"C:\Users\Admin\AppData\Local\Temp\5E1E.tmp"23⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"24⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"25⤵
- Executes dropped EXE
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"26⤵
- Executes dropped EXE
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"27⤵
- Executes dropped EXE
PID:1296 -
C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"C:\Users\Admin\AppData\Local\Temp\5FF2.tmp"28⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"29⤵
- Executes dropped EXE
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"30⤵
- Executes dropped EXE
PID:876 -
C:\Users\Admin\AppData\Local\Temp\610C.tmp"C:\Users\Admin\AppData\Local\Temp\610C.tmp"31⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"32⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"33⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"34⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"35⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"36⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"37⤵
- Executes dropped EXE
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"38⤵
- Executes dropped EXE
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"39⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"40⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"41⤵
- Executes dropped EXE
PID:1928 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"42⤵
- Executes dropped EXE
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"43⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"44⤵
- Executes dropped EXE
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\65BF.tmp"C:\Users\Admin\AppData\Local\Temp\65BF.tmp"45⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\660D.tmp"C:\Users\Admin\AppData\Local\Temp\660D.tmp"46⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"47⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"48⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"49⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"50⤵
- Executes dropped EXE
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"51⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\6820.tmp"C:\Users\Admin\AppData\Local\Temp\6820.tmp"52⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"53⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\68BC.tmp"C:\Users\Admin\AppData\Local\Temp\68BC.tmp"54⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"55⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"56⤵
- Executes dropped EXE
PID:3252 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"57⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"58⤵
- Executes dropped EXE
PID:852 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"59⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"60⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"61⤵
- Executes dropped EXE
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"62⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"63⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"64⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"65⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"66⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"C:\Users\Admin\AppData\Local\Temp\6CF2.tmp"67⤵PID:1688
-
C:\Users\Admin\AppData\Local\Temp\6D41.tmp"C:\Users\Admin\AppData\Local\Temp\6D41.tmp"68⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"69⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"70⤵PID:3168
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"71⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"72⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"73⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\6F25.tmp"C:\Users\Admin\AppData\Local\Temp\6F25.tmp"74⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\6F73.tmp"C:\Users\Admin\AppData\Local\Temp\6F73.tmp"75⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"C:\Users\Admin\AppData\Local\Temp\6FC1.tmp"76⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\700F.tmp"C:\Users\Admin\AppData\Local\Temp\700F.tmp"77⤵PID:4132
-
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"78⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\70AC.tmp"C:\Users\Admin\AppData\Local\Temp\70AC.tmp"79⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\70EA.tmp"C:\Users\Admin\AppData\Local\Temp\70EA.tmp"80⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7138.tmp"C:\Users\Admin\AppData\Local\Temp\7138.tmp"81⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"82⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"83⤵PID:4568
-
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"84⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"85⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"86⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"87⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"88⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"89⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"90⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\7445.tmp"C:\Users\Admin\AppData\Local\Temp\7445.tmp"91⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\7494.tmp"C:\Users\Admin\AppData\Local\Temp\7494.tmp"92⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"93⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\7530.tmp"C:\Users\Admin\AppData\Local\Temp\7530.tmp"94⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"95⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\75CC.tmp"C:\Users\Admin\AppData\Local\Temp\75CC.tmp"96⤵PID:2200
-
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"97⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"98⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"99⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\76F5.tmp"C:\Users\Admin\AppData\Local\Temp\76F5.tmp"100⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7743.tmp"C:\Users\Admin\AppData\Local\Temp\7743.tmp"101⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"102⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\77D0.tmp"C:\Users\Admin\AppData\Local\Temp\77D0.tmp"103⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\781E.tmp"C:\Users\Admin\AppData\Local\Temp\781E.tmp"104⤵PID:4692
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"105⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"106⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\78F9.tmp"C:\Users\Admin\AppData\Local\Temp\78F9.tmp"107⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"108⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\7995.tmp"C:\Users\Admin\AppData\Local\Temp\7995.tmp"109⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\79E3.tmp"C:\Users\Admin\AppData\Local\Temp\79E3.tmp"110⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\7A31.tmp"C:\Users\Admin\AppData\Local\Temp\7A31.tmp"111⤵PID:1536
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"112⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"113⤵PID:3756
-
C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"C:\Users\Admin\AppData\Local\Temp\7B1B.tmp"114⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"115⤵PID:4616
-
C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"C:\Users\Admin\AppData\Local\Temp\7BC7.tmp"116⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"117⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\7C54.tmp"C:\Users\Admin\AppData\Local\Temp\7C54.tmp"118⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"119⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"C:\Users\Admin\AppData\Local\Temp\7CE1.tmp"120⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"C:\Users\Admin\AppData\Local\Temp\7D2F.tmp"121⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"C:\Users\Admin\AppData\Local\Temp\7D7D.tmp"122⤵PID:232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-