Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 13:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe
-
Size
520KB
-
MD5
b5d6ac8658b701cc23ddb0f824b50301
-
SHA1
76dc34ef69ab4fa7da8f457b9376d4bc62f21c7a
-
SHA256
813d135af6e27216b5b4803939f85b2e109d55c8025412f6db75389d8edad356
-
SHA512
df723ef66f210f4d0bbfdd9c638e047c74e22ee80da36416db80b00e1f3405ac583a4939d0f4c61cbcd888ededf666e0d245d707c7b068692a31e968a4cbca3a
-
SSDEEP
12288:roRXOQjmOyWd/sGQnUBUTVHjCQVPIZWRh3FZy2yNZ:rogQ9ycsGQnaUTVHjCOPIZc/QHN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2576 49EA.tmp 2396 4A57.tmp 800 4AD4.tmp 4948 4B32.tmp 3296 4B80.tmp 1016 4BFD.tmp 3584 4C7A.tmp 2372 4CD8.tmp 1996 4D26.tmp 2740 4DA3.tmp 2548 4E01.tmp 1536 4E4F.tmp 2104 4ECC.tmp 3720 4F29.tmp 1360 4F78.tmp 536 5004.tmp 3300 5052.tmp 1732 50C0.tmp 4472 512D.tmp 4916 518B.tmp 1376 51E9.tmp 60 5237.tmp 3036 52B4.tmp 1056 5321.tmp 3788 53AE.tmp 4044 53FC.tmp 4516 5479.tmp 3708 54F6.tmp 2324 5573.tmp 4864 55C1.tmp 4740 561F.tmp 1396 568C.tmp 3576 56EA.tmp 2100 5738.tmp 2336 5786.tmp 2680 57D4.tmp 1504 5822.tmp 3352 5870.tmp 2244 58CE.tmp 2876 591C.tmp 2076 596A.tmp 2256 59B9.tmp 4272 5A16.tmp 3392 5A74.tmp 4368 5AD2.tmp 1720 5B20.tmp 1604 5B6E.tmp 1392 5BCC.tmp 2688 5C1A.tmp 1964 5C78.tmp 1736 5CC6.tmp 4604 5D14.tmp 3356 5D62.tmp 4328 5DB0.tmp 2576 5DFE.tmp 224 5E5C.tmp 4500 5EAA.tmp 4984 5EF8.tmp 2300 5F56.tmp 4820 5FA4.tmp 2416 6002.tmp 5080 6060.tmp 4420 60BD.tmp 436 611B.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1616 wrote to memory of 2576 1616 2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe 82 PID 1616 wrote to memory of 2576 1616 2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe 82 PID 1616 wrote to memory of 2576 1616 2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe 82 PID 2576 wrote to memory of 2396 2576 49EA.tmp 83 PID 2576 wrote to memory of 2396 2576 49EA.tmp 83 PID 2576 wrote to memory of 2396 2576 49EA.tmp 83 PID 2396 wrote to memory of 800 2396 4A57.tmp 85 PID 2396 wrote to memory of 800 2396 4A57.tmp 85 PID 2396 wrote to memory of 800 2396 4A57.tmp 85 PID 800 wrote to memory of 4948 800 4AD4.tmp 87 PID 800 wrote to memory of 4948 800 4AD4.tmp 87 PID 800 wrote to memory of 4948 800 4AD4.tmp 87 PID 4948 wrote to memory of 3296 4948 4B32.tmp 88 PID 4948 wrote to memory of 3296 4948 4B32.tmp 88 PID 4948 wrote to memory of 3296 4948 4B32.tmp 88 PID 3296 wrote to memory of 1016 3296 4B80.tmp 90 PID 3296 wrote to memory of 1016 3296 4B80.tmp 90 PID 3296 wrote to memory of 1016 3296 4B80.tmp 90 PID 1016 wrote to memory of 3584 1016 4BFD.tmp 91 PID 1016 wrote to memory of 3584 1016 4BFD.tmp 91 PID 1016 wrote to memory of 3584 1016 4BFD.tmp 91 PID 3584 wrote to memory of 2372 3584 4C7A.tmp 92 PID 3584 wrote to memory of 2372 3584 4C7A.tmp 92 PID 3584 wrote to memory of 2372 3584 4C7A.tmp 92 PID 2372 wrote to memory of 1996 2372 4CD8.tmp 93 PID 2372 wrote to memory of 1996 2372 4CD8.tmp 93 PID 2372 wrote to memory of 1996 2372 4CD8.tmp 93 PID 1996 wrote to memory of 2740 1996 4D26.tmp 94 PID 1996 wrote to memory of 2740 1996 4D26.tmp 94 PID 1996 wrote to memory of 2740 1996 4D26.tmp 94 PID 2740 wrote to memory of 2548 2740 4DA3.tmp 95 PID 2740 wrote to memory of 2548 2740 4DA3.tmp 95 PID 2740 wrote to memory of 2548 2740 4DA3.tmp 95 PID 2548 wrote to memory of 1536 2548 4E01.tmp 96 PID 2548 wrote to memory of 1536 2548 4E01.tmp 96 PID 2548 wrote to memory of 1536 2548 4E01.tmp 96 PID 1536 wrote to memory of 2104 1536 4E4F.tmp 97 PID 1536 wrote to memory of 2104 1536 4E4F.tmp 97 PID 1536 wrote to memory of 2104 1536 4E4F.tmp 97 PID 2104 wrote to memory of 3720 2104 4ECC.tmp 98 PID 2104 wrote to memory of 3720 2104 4ECC.tmp 98 PID 2104 wrote to memory of 3720 2104 4ECC.tmp 98 PID 3720 wrote to memory of 1360 3720 4F29.tmp 99 PID 3720 wrote to memory of 1360 3720 4F29.tmp 99 PID 3720 wrote to memory of 1360 3720 4F29.tmp 99 PID 1360 wrote to memory of 536 1360 4F78.tmp 100 PID 1360 wrote to memory of 536 1360 4F78.tmp 100 PID 1360 wrote to memory of 536 1360 4F78.tmp 100 PID 536 wrote to memory of 3300 536 5004.tmp 101 PID 536 wrote to memory of 3300 536 5004.tmp 101 PID 536 wrote to memory of 3300 536 5004.tmp 101 PID 3300 wrote to memory of 1732 3300 5052.tmp 102 PID 3300 wrote to memory of 1732 3300 5052.tmp 102 PID 3300 wrote to memory of 1732 3300 5052.tmp 102 PID 1732 wrote to memory of 4472 1732 50C0.tmp 103 PID 1732 wrote to memory of 4472 1732 50C0.tmp 103 PID 1732 wrote to memory of 4472 1732 50C0.tmp 103 PID 4472 wrote to memory of 4916 4472 512D.tmp 104 PID 4472 wrote to memory of 4916 4472 512D.tmp 104 PID 4472 wrote to memory of 4916 4472 512D.tmp 104 PID 4916 wrote to memory of 1376 4916 518B.tmp 105 PID 4916 wrote to memory of 1376 4916 518B.tmp 105 PID 4916 wrote to memory of 1376 4916 518B.tmp 105 PID 1376 wrote to memory of 60 1376 51E9.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-10_b5d6ac8658b701cc23ddb0f824b50301_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"C:\Users\Admin\AppData\Local\Temp\4C7A.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"C:\Users\Admin\AppData\Local\Temp\4E4F.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\4F29.tmp"C:\Users\Admin\AppData\Local\Temp\4F29.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"23⤵
- Executes dropped EXE
PID:60 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"24⤵
- Executes dropped EXE
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"25⤵
- Executes dropped EXE
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"26⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"27⤵
- Executes dropped EXE
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"28⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"29⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"30⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"31⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"32⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\568C.tmp"C:\Users\Admin\AppData\Local\Temp\568C.tmp"33⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\56EA.tmp"C:\Users\Admin\AppData\Local\Temp\56EA.tmp"34⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\5738.tmp"C:\Users\Admin\AppData\Local\Temp\5738.tmp"35⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"36⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"37⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"38⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"39⤵
- Executes dropped EXE
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"40⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"41⤵
- Executes dropped EXE
PID:2876 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"42⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"43⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"44⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"45⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"46⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"47⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"48⤵
- Executes dropped EXE
PID:1604 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"49⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"50⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"51⤵
- Executes dropped EXE
PID:1964 -
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"52⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"53⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"54⤵
- Executes dropped EXE
PID:3356 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"55⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"56⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"57⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"C:\Users\Admin\AppData\Local\Temp\5EAA.tmp"58⤵
- Executes dropped EXE
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"C:\Users\Admin\AppData\Local\Temp\5EF8.tmp"59⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\5F56.tmp"C:\Users\Admin\AppData\Local\Temp\5F56.tmp"60⤵
- Executes dropped EXE
PID:2300 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"61⤵
- Executes dropped EXE
PID:4820 -
C:\Users\Admin\AppData\Local\Temp\6002.tmp"C:\Users\Admin\AppData\Local\Temp\6002.tmp"62⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\6060.tmp"C:\Users\Admin\AppData\Local\Temp\6060.tmp"63⤵
- Executes dropped EXE
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"64⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"65⤵
- Executes dropped EXE
PID:436 -
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"66⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"67⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"68⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"69⤵PID:3280
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"70⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"71⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"72⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\63DA.tmp"C:\Users\Admin\AppData\Local\Temp\63DA.tmp"73⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"74⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"75⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"76⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"77⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"78⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"79⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"80⤵PID:1384
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"81⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"82⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\6745.tmp"C:\Users\Admin\AppData\Local\Temp\6745.tmp"83⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"84⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"85⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"86⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"87⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\68DC.tmp"C:\Users\Admin\AppData\Local\Temp\68DC.tmp"88⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"89⤵PID:3036
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"90⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\69E5.tmp"C:\Users\Admin\AppData\Local\Temp\69E5.tmp"91⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\6A43.tmp"C:\Users\Admin\AppData\Local\Temp\6A43.tmp"92⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\6A91.tmp"C:\Users\Admin\AppData\Local\Temp\6A91.tmp"93⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"C:\Users\Admin\AppData\Local\Temp\6ADF.tmp"94⤵PID:3884
-
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"95⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"96⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"97⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\6C27.tmp"C:\Users\Admin\AppData\Local\Temp\6C27.tmp"98⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"99⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"100⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\6D21.tmp"C:\Users\Admin\AppData\Local\Temp\6D21.tmp"101⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"102⤵PID:3496
-
C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"C:\Users\Admin\AppData\Local\Temp\6DDD.tmp"103⤵PID:4188
-
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"104⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"105⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"106⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"107⤵PID:532
-
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"108⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"109⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"110⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"111⤵PID:3148
-
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"112⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\7109.tmp"C:\Users\Admin\AppData\Local\Temp\7109.tmp"113⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\7157.tmp"C:\Users\Admin\AppData\Local\Temp\7157.tmp"114⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\71A6.tmp"C:\Users\Admin\AppData\Local\Temp\71A6.tmp"115⤵PID:3768
-
C:\Users\Admin\AppData\Local\Temp\71F4.tmp"C:\Users\Admin\AppData\Local\Temp\71F4.tmp"116⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"117⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"118⤵PID:3024
-
C:\Users\Admin\AppData\Local\Temp\72DE.tmp"C:\Users\Admin\AppData\Local\Temp\72DE.tmp"119⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\732C.tmp"C:\Users\Admin\AppData\Local\Temp\732C.tmp"120⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"121⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\73E8.tmp"C:\Users\Admin\AppData\Local\Temp\73E8.tmp"122⤵PID:1364
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-