Analysis
-
max time kernel
150s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 16:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe
-
Size
527KB
-
MD5
ae0895f9b5702753cc5edf81648c0649
-
SHA1
d0054246d46cea9243703f8d8891258898f05087
-
SHA256
a06112603212c2c5b4ca3a4116f393ff2ef8babc379c0a033cea61cfad892ac4
-
SHA512
9fd86a9626d87139f5399a840ea49d67b17a219eb1388183b4882d29fdd3582e8a2e76fe0be3bdf478995b22b603f6cb1c690b752d7e194d103a1df2969e0abc
-
SSDEEP
6144:yorf3lPvovsgZnqG2C7mOTeiLRDYiiXKfDJ59FUOmhQopdyaj1ST6VkuwSWvQGy3:fU5rCOTeid9iilpQhqB/YGyX30DZu
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4100 42D5.tmp 1248 4362.tmp 3520 43C0.tmp 2488 443D.tmp 2892 44C9.tmp 3896 4537.tmp 1568 4594.tmp 4580 45F2.tmp 4616 465F.tmp 3472 46CD.tmp 1156 473A.tmp 3596 4798.tmp 2760 47E6.tmp 2524 4853.tmp 4696 48C1.tmp 1200 493E.tmp 2460 499C.tmp 1556 49F9.tmp 3716 4A76.tmp 2600 4AF3.tmp 460 4B61.tmp 1616 4BBE.tmp 2060 4C1C.tmp 3840 4C6A.tmp 4676 4CF7.tmp 4704 4D55.tmp 1056 4DC2.tmp 2016 4E10.tmp 4532 4E6E.tmp 4984 4EDB.tmp 1184 4F49.tmp 3172 4FC6.tmp 3112 5014.tmp 4588 5062.tmp 64 50B0.tmp 1544 510E.tmp 3432 516C.tmp 3896 51BA.tmp 1568 5208.tmp 1504 5266.tmp 2988 52B4.tmp 1440 5311.tmp 1484 536F.tmp 2724 53BD.tmp 3704 541B.tmp 2940 5479.tmp 4812 54D7.tmp 3628 5534.tmp 3484 5592.tmp 4944 55F0.tmp 5008 564E.tmp 2524 569C.tmp 2772 56EA.tmp 2292 5748.tmp 368 57A5.tmp 2216 57F3.tmp 2896 5851.tmp 4124 58AF.tmp 1332 590D.tmp 3000 595B.tmp 4900 59B9.tmp 1476 5A16.tmp 1580 5A74.tmp 1660 5AC2.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4856 wrote to memory of 4100 4856 2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe 82 PID 4856 wrote to memory of 4100 4856 2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe 82 PID 4856 wrote to memory of 4100 4856 2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe 82 PID 4100 wrote to memory of 1248 4100 42D5.tmp 83 PID 4100 wrote to memory of 1248 4100 42D5.tmp 83 PID 4100 wrote to memory of 1248 4100 42D5.tmp 83 PID 1248 wrote to memory of 3520 1248 4362.tmp 84 PID 1248 wrote to memory of 3520 1248 4362.tmp 84 PID 1248 wrote to memory of 3520 1248 4362.tmp 84 PID 3520 wrote to memory of 2488 3520 43C0.tmp 85 PID 3520 wrote to memory of 2488 3520 43C0.tmp 85 PID 3520 wrote to memory of 2488 3520 43C0.tmp 85 PID 2488 wrote to memory of 2892 2488 443D.tmp 86 PID 2488 wrote to memory of 2892 2488 443D.tmp 86 PID 2488 wrote to memory of 2892 2488 443D.tmp 86 PID 2892 wrote to memory of 3896 2892 44C9.tmp 87 PID 2892 wrote to memory of 3896 2892 44C9.tmp 87 PID 2892 wrote to memory of 3896 2892 44C9.tmp 87 PID 3896 wrote to memory of 1568 3896 4537.tmp 89 PID 3896 wrote to memory of 1568 3896 4537.tmp 89 PID 3896 wrote to memory of 1568 3896 4537.tmp 89 PID 1568 wrote to memory of 4580 1568 4594.tmp 90 PID 1568 wrote to memory of 4580 1568 4594.tmp 90 PID 1568 wrote to memory of 4580 1568 4594.tmp 90 PID 4580 wrote to memory of 4616 4580 45F2.tmp 91 PID 4580 wrote to memory of 4616 4580 45F2.tmp 91 PID 4580 wrote to memory of 4616 4580 45F2.tmp 91 PID 4616 wrote to memory of 3472 4616 465F.tmp 92 PID 4616 wrote to memory of 3472 4616 465F.tmp 92 PID 4616 wrote to memory of 3472 4616 465F.tmp 92 PID 3472 wrote to memory of 1156 3472 46CD.tmp 95 PID 3472 wrote to memory of 1156 3472 46CD.tmp 95 PID 3472 wrote to memory of 1156 3472 46CD.tmp 95 PID 1156 wrote to memory of 3596 1156 473A.tmp 96 PID 1156 wrote to memory of 3596 1156 473A.tmp 96 PID 1156 wrote to memory of 3596 1156 473A.tmp 96 PID 3596 wrote to memory of 2760 3596 4798.tmp 97 PID 3596 wrote to memory of 2760 3596 4798.tmp 97 PID 3596 wrote to memory of 2760 3596 4798.tmp 97 PID 2760 wrote to memory of 2524 2760 47E6.tmp 99 PID 2760 wrote to memory of 2524 2760 47E6.tmp 99 PID 2760 wrote to memory of 2524 2760 47E6.tmp 99 PID 2524 wrote to memory of 4696 2524 4853.tmp 100 PID 2524 wrote to memory of 4696 2524 4853.tmp 100 PID 2524 wrote to memory of 4696 2524 4853.tmp 100 PID 4696 wrote to memory of 1200 4696 48C1.tmp 101 PID 4696 wrote to memory of 1200 4696 48C1.tmp 101 PID 4696 wrote to memory of 1200 4696 48C1.tmp 101 PID 1200 wrote to memory of 2460 1200 493E.tmp 102 PID 1200 wrote to memory of 2460 1200 493E.tmp 102 PID 1200 wrote to memory of 2460 1200 493E.tmp 102 PID 2460 wrote to memory of 1556 2460 499C.tmp 103 PID 2460 wrote to memory of 1556 2460 499C.tmp 103 PID 2460 wrote to memory of 1556 2460 499C.tmp 103 PID 1556 wrote to memory of 3716 1556 49F9.tmp 104 PID 1556 wrote to memory of 3716 1556 49F9.tmp 104 PID 1556 wrote to memory of 3716 1556 49F9.tmp 104 PID 3716 wrote to memory of 2600 3716 4A76.tmp 105 PID 3716 wrote to memory of 2600 3716 4A76.tmp 105 PID 3716 wrote to memory of 2600 3716 4A76.tmp 105 PID 2600 wrote to memory of 460 2600 4AF3.tmp 106 PID 2600 wrote to memory of 460 2600 4AF3.tmp 106 PID 2600 wrote to memory of 460 2600 4AF3.tmp 106 PID 460 wrote to memory of 1616 460 4B61.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-20_ae0895f9b5702753cc5edf81648c0649_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\44C9.tmp"C:\Users\Admin\AppData\Local\Temp\44C9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\493E.tmp"C:\Users\Admin\AppData\Local\Temp\493E.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:460 -
C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"C:\Users\Admin\AppData\Local\Temp\4BBE.tmp"23⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"C:\Users\Admin\AppData\Local\Temp\4C1C.tmp"24⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"25⤵
- Executes dropped EXE
PID:3840 -
C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"C:\Users\Admin\AppData\Local\Temp\4CF7.tmp"26⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\4D55.tmp"C:\Users\Admin\AppData\Local\Temp\4D55.tmp"27⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"28⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"29⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"C:\Users\Admin\AppData\Local\Temp\4E6E.tmp"30⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"31⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"32⤵
- Executes dropped EXE
PID:1184 -
C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"C:\Users\Admin\AppData\Local\Temp\4FC6.tmp"33⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\5014.tmp"C:\Users\Admin\AppData\Local\Temp\5014.tmp"34⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"35⤵
- Executes dropped EXE
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"36⤵
- Executes dropped EXE
PID:64 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"37⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"38⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"39⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"40⤵
- Executes dropped EXE
PID:1568 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"41⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"42⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"43⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"44⤵
- Executes dropped EXE
PID:1484 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"45⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"46⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"47⤵
- Executes dropped EXE
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"48⤵
- Executes dropped EXE
PID:4812 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"49⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"50⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"51⤵
- Executes dropped EXE
PID:4944 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"52⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"53⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"54⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\5748.tmp"C:\Users\Admin\AppData\Local\Temp\5748.tmp"55⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"56⤵
- Executes dropped EXE
PID:368 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"57⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"58⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"59⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"60⤵
- Executes dropped EXE
PID:1332 -
C:\Users\Admin\AppData\Local\Temp\595B.tmp"C:\Users\Admin\AppData\Local\Temp\595B.tmp"61⤵
- Executes dropped EXE
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"62⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"63⤵
- Executes dropped EXE
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"64⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"65⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"66⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"67⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"68⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"69⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"70⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"71⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"72⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"73⤵PID:2016
-
C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"C:\Users\Admin\AppData\Local\Temp\5DEF.tmp"74⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"75⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"76⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"77⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"78⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"79⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6012.tmp"C:\Users\Admin\AppData\Local\Temp\6012.tmp"80⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"81⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"82⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"83⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"84⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"85⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"86⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"87⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"88⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\633E.tmp"C:\Users\Admin\AppData\Local\Temp\633E.tmp"89⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"90⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"91⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"92⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"93⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"94⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"95⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"96⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"97⤵PID:2512
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"98⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"99⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"100⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\6784.tmp"C:\Users\Admin\AppData\Local\Temp\6784.tmp"101⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"102⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\683F.tmp"C:\Users\Admin\AppData\Local\Temp\683F.tmp"103⤵PID:4120
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"104⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"105⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"106⤵PID:4492
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"107⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"108⤵PID:3652
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"109⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"110⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"111⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"112⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"113⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"114⤵PID:460
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"115⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"116⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"117⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"C:\Users\Admin\AppData\Local\Temp\6D6F.tmp"118⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"119⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"120⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"121⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"C:\Users\Admin\AppData\Local\Temp\6EA8.tmp"122⤵PID:1780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-