Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
26/05/2024, 11:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe
Resource
win10v2004-20240426-en
2 signatures
150 seconds
General
-
Target
2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe
-
Size
520KB
-
MD5
d351054cb7f601ee0f724122b25b4a73
-
SHA1
1cb56ca3ff013c25c686646850c791b40c90207d
-
SHA256
af71e28eb5789be867b68bd823d58f4b62eceb56779cc171c147d12330caf58d
-
SHA512
4dc21d4cdeed20cdd2b1a5b1579eacc181c92e6c0cbb72feceddb45c450e194cabd0bc360290d1d73babf869ca6c6f3e41517d788cb3517c20ffeeebacec55ef
-
SSDEEP
12288:roRXOQjmOyoNrNatbM3jYuaW4NsPuZ3RH20NZ:rogQ9yoNrNKM3pXPuvN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3196 4093.tmp 544 4110.tmp 1096 41BC.tmp 1188 4229.tmp 3884 4297.tmp 4384 4314.tmp 3388 4391.tmp 4272 43FE.tmp 540 444C.tmp 4168 44D9.tmp 720 4537.tmp 1300 45A4.tmp 4600 4611.tmp 2432 468E.tmp 3440 46EC.tmp 2320 4759.tmp 2112 47B7.tmp 2052 4805.tmp 1132 4853.tmp 2072 48C1.tmp 2216 492E.tmp 4172 49AB.tmp 1828 49F9.tmp 3676 4A47.tmp 4628 4AB5.tmp 536 4B32.tmp 1688 4BAF.tmp 4660 4BFD.tmp 3172 4C5B.tmp 4340 4CC8.tmp 2276 4D16.tmp 4580 4D74.tmp 5052 4DE1.tmp 812 4E2F.tmp 2232 4E9D.tmp 2032 4EEB.tmp 2160 4F49.tmp 3004 4FA6.tmp 4568 4FF5.tmp 2196 5052.tmp 4496 50C0.tmp 1320 510E.tmp 3920 515C.tmp 3628 51BA.tmp 2024 5217.tmp 3596 5266.tmp 4084 52C3.tmp 2656 5311.tmp 4548 5360.tmp 3884 53CD.tmp 5032 541B.tmp 4244 5479.tmp 4384 54D7.tmp 4380 5534.tmp 396 5592.tmp 4272 55E0.tmp 3212 562E.tmp 4228 567C.tmp 1060 56DA.tmp 2284 5728.tmp 2812 5786.tmp 1380 57E4.tmp 1248 5832.tmp 4604 5880.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3196 2148 2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe 83 PID 2148 wrote to memory of 3196 2148 2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe 83 PID 2148 wrote to memory of 3196 2148 2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe 83 PID 3196 wrote to memory of 544 3196 4093.tmp 84 PID 3196 wrote to memory of 544 3196 4093.tmp 84 PID 3196 wrote to memory of 544 3196 4093.tmp 84 PID 544 wrote to memory of 1096 544 4110.tmp 85 PID 544 wrote to memory of 1096 544 4110.tmp 85 PID 544 wrote to memory of 1096 544 4110.tmp 85 PID 1096 wrote to memory of 1188 1096 41BC.tmp 86 PID 1096 wrote to memory of 1188 1096 41BC.tmp 86 PID 1096 wrote to memory of 1188 1096 41BC.tmp 86 PID 1188 wrote to memory of 3884 1188 4229.tmp 87 PID 1188 wrote to memory of 3884 1188 4229.tmp 87 PID 1188 wrote to memory of 3884 1188 4229.tmp 87 PID 3884 wrote to memory of 4384 3884 4297.tmp 90 PID 3884 wrote to memory of 4384 3884 4297.tmp 90 PID 3884 wrote to memory of 4384 3884 4297.tmp 90 PID 4384 wrote to memory of 3388 4384 4314.tmp 91 PID 4384 wrote to memory of 3388 4384 4314.tmp 91 PID 4384 wrote to memory of 3388 4384 4314.tmp 91 PID 3388 wrote to memory of 4272 3388 4391.tmp 92 PID 3388 wrote to memory of 4272 3388 4391.tmp 92 PID 3388 wrote to memory of 4272 3388 4391.tmp 92 PID 4272 wrote to memory of 540 4272 43FE.tmp 93 PID 4272 wrote to memory of 540 4272 43FE.tmp 93 PID 4272 wrote to memory of 540 4272 43FE.tmp 93 PID 540 wrote to memory of 4168 540 444C.tmp 94 PID 540 wrote to memory of 4168 540 444C.tmp 94 PID 540 wrote to memory of 4168 540 444C.tmp 94 PID 4168 wrote to memory of 720 4168 44D9.tmp 95 PID 4168 wrote to memory of 720 4168 44D9.tmp 95 PID 4168 wrote to memory of 720 4168 44D9.tmp 95 PID 720 wrote to memory of 1300 720 4537.tmp 96 PID 720 wrote to memory of 1300 720 4537.tmp 96 PID 720 wrote to memory of 1300 720 4537.tmp 96 PID 1300 wrote to memory of 4600 1300 45A4.tmp 97 PID 1300 wrote to memory of 4600 1300 45A4.tmp 97 PID 1300 wrote to memory of 4600 1300 45A4.tmp 97 PID 4600 wrote to memory of 2432 4600 4611.tmp 98 PID 4600 wrote to memory of 2432 4600 4611.tmp 98 PID 4600 wrote to memory of 2432 4600 4611.tmp 98 PID 2432 wrote to memory of 3440 2432 468E.tmp 99 PID 2432 wrote to memory of 3440 2432 468E.tmp 99 PID 2432 wrote to memory of 3440 2432 468E.tmp 99 PID 3440 wrote to memory of 2320 3440 46EC.tmp 100 PID 3440 wrote to memory of 2320 3440 46EC.tmp 100 PID 3440 wrote to memory of 2320 3440 46EC.tmp 100 PID 2320 wrote to memory of 2112 2320 4759.tmp 101 PID 2320 wrote to memory of 2112 2320 4759.tmp 101 PID 2320 wrote to memory of 2112 2320 4759.tmp 101 PID 2112 wrote to memory of 2052 2112 47B7.tmp 102 PID 2112 wrote to memory of 2052 2112 47B7.tmp 102 PID 2112 wrote to memory of 2052 2112 47B7.tmp 102 PID 2052 wrote to memory of 1132 2052 4805.tmp 103 PID 2052 wrote to memory of 1132 2052 4805.tmp 103 PID 2052 wrote to memory of 1132 2052 4805.tmp 103 PID 1132 wrote to memory of 2072 1132 4853.tmp 104 PID 1132 wrote to memory of 2072 1132 4853.tmp 104 PID 1132 wrote to memory of 2072 1132 4853.tmp 104 PID 2072 wrote to memory of 2216 2072 48C1.tmp 105 PID 2072 wrote to memory of 2216 2072 48C1.tmp 105 PID 2072 wrote to memory of 2216 2072 48C1.tmp 105 PID 2216 wrote to memory of 4172 2216 492E.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-26_d351054cb7f601ee0f724122b25b4a73_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\4110.tmp"C:\Users\Admin\AppData\Local\Temp\4110.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\4314.tmp"C:\Users\Admin\AppData\Local\Temp\4314.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\43FE.tmp"C:\Users\Admin\AppData\Local\Temp\43FE.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\46EC.tmp"C:\Users\Admin\AppData\Local\Temp\46EC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1132 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\49AB.tmp"C:\Users\Admin\AppData\Local\Temp\49AB.tmp"23⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"24⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\4A47.tmp"C:\Users\Admin\AppData\Local\Temp\4A47.tmp"25⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"26⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"27⤵
- Executes dropped EXE
PID:536 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"28⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"29⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"30⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"31⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"32⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4D74.tmp"C:\Users\Admin\AppData\Local\Temp\4D74.tmp"33⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"34⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"35⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"36⤵
- Executes dropped EXE
PID:2232 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"37⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"38⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"39⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"40⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"41⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"42⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"43⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"44⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"45⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"46⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"47⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"48⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"49⤵
- Executes dropped EXE
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"50⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"51⤵
- Executes dropped EXE
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"52⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"53⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\54D7.tmp"C:\Users\Admin\AppData\Local\Temp\54D7.tmp"54⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"55⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"56⤵
- Executes dropped EXE
PID:396 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"57⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"58⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"59⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\56DA.tmp"C:\Users\Admin\AppData\Local\Temp\56DA.tmp"60⤵
- Executes dropped EXE
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"61⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"62⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\57E4.tmp"C:\Users\Admin\AppData\Local\Temp\57E4.tmp"63⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"64⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"65⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"66⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"67⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"68⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"69⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"70⤵PID:3080
-
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"71⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"72⤵PID:1436
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"73⤵PID:1716
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"74⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"75⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"76⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"77⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"78⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"79⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"80⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"81⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"82⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"83⤵PID:1392
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"84⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"85⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"86⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"87⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"88⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"89⤵PID:4024
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"90⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"91⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"92⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"93⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"94⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"95⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"96⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"97⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"98⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"99⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"100⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"101⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"102⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"103⤵PID:804
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"104⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\66A9.tmp"C:\Users\Admin\AppData\Local\Temp\66A9.tmp"105⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"106⤵PID:2052
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"107⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"108⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"109⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"110⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"111⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"112⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"113⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"114⤵PID:3560
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"115⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"116⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"117⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"118⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"119⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"C:\Users\Admin\AppData\Local\Temp\6BAA.tmp"120⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"121⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"122⤵PID:812
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-