Analysis
-
max time kernel
150s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2024, 17:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe
Resource
win7-20240611-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe
-
Size
520KB
-
MD5
5521242d047ca6836d627c0c8feeb1bb
-
SHA1
f83088fb6f776fbb0f26e400e8406c40fa748655
-
SHA256
73f8a97cbf0bf903c2ac78982b553660e972b444a41dc9b660b0bbb6184bdbd8
-
SHA512
2cc52b81816e5cdb375745ee2717de27806ada49a9bc71294244b57727bcf0d497567e1324d9b1777424327331622cd78afd2e957ab9ab0e1cb45b1844693ffb
-
SSDEEP
12288:roRXOQjmOyOlBHuViYkd4enuZ1ihO9iNZ:rogQ9yOlBHVeeQ1inN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4888 AA93.tmp 2008 AB2F.tmp 2028 AD62.tmp 2596 ADFE.tmp 1000 AE7B.tmp 4288 AEE8.tmp 1076 AF85.tmp 2500 B021.tmp 4556 B0BD.tmp 3812 B14A.tmp 4564 B1C7.tmp 4272 B244.tmp 2312 B2A1.tmp 408 B32E.tmp 1140 B39B.tmp 916 B409.tmp 1256 B467.tmp 3892 B4E4.tmp 828 B551.tmp 1248 B5CE.tmp 1564 B65B.tmp 4248 B6E7.tmp 1512 B755.tmp 3060 B7E1.tmp 860 B85E.tmp 4148 B8EB.tmp 3544 B968.tmp 4472 BA04.tmp 212 BA71.tmp 3368 BAFE.tmp 1916 BC08.tmp 4772 BC94.tmp 932 BD21.tmp 2704 BD8E.tmp 4556 BDEC.tmp 3812 BE4A.tmp 1588 BEB7.tmp 3008 BF15.tmp 1536 BF73.tmp 684 BFE0.tmp 880 C04D.tmp 1396 C0F9.tmp 2680 C157.tmp 912 C1C4.tmp 4640 C222.tmp 1080 C280.tmp 3388 C2FD.tmp 4188 C35B.tmp 4124 C3D8.tmp 4080 C445.tmp 4496 C4B2.tmp 3044 C520.tmp 2124 C59D.tmp 764 C60A.tmp 2116 C668.tmp 4160 C6E5.tmp 3760 C752.tmp 3544 C7CF.tmp 2520 C82D.tmp 2324 C89A.tmp 4572 C8F8.tmp 4884 C966.tmp 1644 C9D3.tmp 4760 CA40.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 4888 2504 2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe 92 PID 2504 wrote to memory of 4888 2504 2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe 92 PID 2504 wrote to memory of 4888 2504 2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe 92 PID 4888 wrote to memory of 2008 4888 AA93.tmp 93 PID 4888 wrote to memory of 2008 4888 AA93.tmp 93 PID 4888 wrote to memory of 2008 4888 AA93.tmp 93 PID 2008 wrote to memory of 2028 2008 AB2F.tmp 94 PID 2008 wrote to memory of 2028 2008 AB2F.tmp 94 PID 2008 wrote to memory of 2028 2008 AB2F.tmp 94 PID 2028 wrote to memory of 2596 2028 AD62.tmp 96 PID 2028 wrote to memory of 2596 2028 AD62.tmp 96 PID 2028 wrote to memory of 2596 2028 AD62.tmp 96 PID 2596 wrote to memory of 1000 2596 ADFE.tmp 97 PID 2596 wrote to memory of 1000 2596 ADFE.tmp 97 PID 2596 wrote to memory of 1000 2596 ADFE.tmp 97 PID 1000 wrote to memory of 4288 1000 AE7B.tmp 98 PID 1000 wrote to memory of 4288 1000 AE7B.tmp 98 PID 1000 wrote to memory of 4288 1000 AE7B.tmp 98 PID 4288 wrote to memory of 1076 4288 AEE8.tmp 99 PID 4288 wrote to memory of 1076 4288 AEE8.tmp 99 PID 4288 wrote to memory of 1076 4288 AEE8.tmp 99 PID 1076 wrote to memory of 2500 1076 AF85.tmp 100 PID 1076 wrote to memory of 2500 1076 AF85.tmp 100 PID 1076 wrote to memory of 2500 1076 AF85.tmp 100 PID 2500 wrote to memory of 4556 2500 B021.tmp 101 PID 2500 wrote to memory of 4556 2500 B021.tmp 101 PID 2500 wrote to memory of 4556 2500 B021.tmp 101 PID 4556 wrote to memory of 3812 4556 B0BD.tmp 102 PID 4556 wrote to memory of 3812 4556 B0BD.tmp 102 PID 4556 wrote to memory of 3812 4556 B0BD.tmp 102 PID 3812 wrote to memory of 4564 3812 B14A.tmp 103 PID 3812 wrote to memory of 4564 3812 B14A.tmp 103 PID 3812 wrote to memory of 4564 3812 B14A.tmp 103 PID 4564 wrote to memory of 4272 4564 B1C7.tmp 104 PID 4564 wrote to memory of 4272 4564 B1C7.tmp 104 PID 4564 wrote to memory of 4272 4564 B1C7.tmp 104 PID 4272 wrote to memory of 2312 4272 B244.tmp 105 PID 4272 wrote to memory of 2312 4272 B244.tmp 105 PID 4272 wrote to memory of 2312 4272 B244.tmp 105 PID 2312 wrote to memory of 408 2312 B2A1.tmp 106 PID 2312 wrote to memory of 408 2312 B2A1.tmp 106 PID 2312 wrote to memory of 408 2312 B2A1.tmp 106 PID 408 wrote to memory of 1140 408 B32E.tmp 107 PID 408 wrote to memory of 1140 408 B32E.tmp 107 PID 408 wrote to memory of 1140 408 B32E.tmp 107 PID 1140 wrote to memory of 916 1140 B39B.tmp 108 PID 1140 wrote to memory of 916 1140 B39B.tmp 108 PID 1140 wrote to memory of 916 1140 B39B.tmp 108 PID 916 wrote to memory of 1256 916 B409.tmp 109 PID 916 wrote to memory of 1256 916 B409.tmp 109 PID 916 wrote to memory of 1256 916 B409.tmp 109 PID 1256 wrote to memory of 3892 1256 B467.tmp 110 PID 1256 wrote to memory of 3892 1256 B467.tmp 110 PID 1256 wrote to memory of 3892 1256 B467.tmp 110 PID 3892 wrote to memory of 828 3892 B4E4.tmp 111 PID 3892 wrote to memory of 828 3892 B4E4.tmp 111 PID 3892 wrote to memory of 828 3892 B4E4.tmp 111 PID 828 wrote to memory of 1248 828 B551.tmp 112 PID 828 wrote to memory of 1248 828 B551.tmp 112 PID 828 wrote to memory of 1248 828 B551.tmp 112 PID 1248 wrote to memory of 1564 1248 B5CE.tmp 113 PID 1248 wrote to memory of 1564 1248 B5CE.tmp 113 PID 1248 wrote to memory of 1564 1248 B5CE.tmp 113 PID 1564 wrote to memory of 4248 1564 B65B.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-30_5521242d047ca6836d627c0c8feeb1bb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\AA93.tmp"C:\Users\Admin\AppData\Local\Temp\AA93.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"C:\Users\Admin\AppData\Local\Temp\AB2F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\AD62.tmp"C:\Users\Admin\AppData\Local\Temp\AD62.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"C:\Users\Admin\AppData\Local\Temp\ADFE.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"C:\Users\Admin\AppData\Local\Temp\AE7B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1000 -
C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"C:\Users\Admin\AppData\Local\Temp\AEE8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Users\Admin\AppData\Local\Temp\AF85.tmp"C:\Users\Admin\AppData\Local\Temp\AF85.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\B021.tmp"C:\Users\Admin\AppData\Local\Temp\B021.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"C:\Users\Admin\AppData\Local\Temp\B0BD.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\B14A.tmp"C:\Users\Admin\AppData\Local\Temp\B14A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"C:\Users\Admin\AppData\Local\Temp\B1C7.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\B244.tmp"C:\Users\Admin\AppData\Local\Temp\B244.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"C:\Users\Admin\AppData\Local\Temp\B2A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\B32E.tmp"C:\Users\Admin\AppData\Local\Temp\B32E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\B39B.tmp"C:\Users\Admin\AppData\Local\Temp\B39B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\B409.tmp"C:\Users\Admin\AppData\Local\Temp\B409.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\B467.tmp"C:\Users\Admin\AppData\Local\Temp\B467.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"C:\Users\Admin\AppData\Local\Temp\B4E4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\B551.tmp"C:\Users\Admin\AppData\Local\Temp\B551.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"C:\Users\Admin\AppData\Local\Temp\B5CE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\B65B.tmp"C:\Users\Admin\AppData\Local\Temp\B65B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"C:\Users\Admin\AppData\Local\Temp\B6E7.tmp"23⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\B755.tmp"C:\Users\Admin\AppData\Local\Temp\B755.tmp"24⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"C:\Users\Admin\AppData\Local\Temp\B7E1.tmp"25⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\B85E.tmp"C:\Users\Admin\AppData\Local\Temp\B85E.tmp"26⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\B8EB.tmp"C:\Users\Admin\AppData\Local\Temp\B8EB.tmp"27⤵
- Executes dropped EXE
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\B968.tmp"C:\Users\Admin\AppData\Local\Temp\B968.tmp"28⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\BA04.tmp"C:\Users\Admin\AppData\Local\Temp\BA04.tmp"29⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\BA71.tmp"C:\Users\Admin\AppData\Local\Temp\BA71.tmp"30⤵
- Executes dropped EXE
PID:212 -
C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"C:\Users\Admin\AppData\Local\Temp\BAFE.tmp"31⤵
- Executes dropped EXE
PID:3368 -
C:\Users\Admin\AppData\Local\Temp\BC08.tmp"C:\Users\Admin\AppData\Local\Temp\BC08.tmp"32⤵
- Executes dropped EXE
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\BC94.tmp"C:\Users\Admin\AppData\Local\Temp\BC94.tmp"33⤵
- Executes dropped EXE
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\BD21.tmp"C:\Users\Admin\AppData\Local\Temp\BD21.tmp"34⤵
- Executes dropped EXE
PID:932 -
C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"C:\Users\Admin\AppData\Local\Temp\BD8E.tmp"35⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"C:\Users\Admin\AppData\Local\Temp\BDEC.tmp"36⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"C:\Users\Admin\AppData\Local\Temp\BE4A.tmp"37⤵
- Executes dropped EXE
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"C:\Users\Admin\AppData\Local\Temp\BEB7.tmp"38⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\BF15.tmp"C:\Users\Admin\AppData\Local\Temp\BF15.tmp"39⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\BF73.tmp"C:\Users\Admin\AppData\Local\Temp\BF73.tmp"40⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"C:\Users\Admin\AppData\Local\Temp\BFE0.tmp"41⤵
- Executes dropped EXE
PID:684 -
C:\Users\Admin\AppData\Local\Temp\C04D.tmp"C:\Users\Admin\AppData\Local\Temp\C04D.tmp"42⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"C:\Users\Admin\AppData\Local\Temp\C0F9.tmp"43⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\C157.tmp"C:\Users\Admin\AppData\Local\Temp\C157.tmp"44⤵
- Executes dropped EXE
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"C:\Users\Admin\AppData\Local\Temp\C1C4.tmp"45⤵
- Executes dropped EXE
PID:912 -
C:\Users\Admin\AppData\Local\Temp\C222.tmp"C:\Users\Admin\AppData\Local\Temp\C222.tmp"46⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\C280.tmp"C:\Users\Admin\AppData\Local\Temp\C280.tmp"47⤵
- Executes dropped EXE
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"C:\Users\Admin\AppData\Local\Temp\C2FD.tmp"48⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\C35B.tmp"C:\Users\Admin\AppData\Local\Temp\C35B.tmp"49⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"C:\Users\Admin\AppData\Local\Temp\C3D8.tmp"50⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\C445.tmp"C:\Users\Admin\AppData\Local\Temp\C445.tmp"51⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"C:\Users\Admin\AppData\Local\Temp\C4B2.tmp"52⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\C520.tmp"C:\Users\Admin\AppData\Local\Temp\C520.tmp"53⤵
- Executes dropped EXE
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\C59D.tmp"C:\Users\Admin\AppData\Local\Temp\C59D.tmp"54⤵
- Executes dropped EXE
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\C60A.tmp"C:\Users\Admin\AppData\Local\Temp\C60A.tmp"55⤵
- Executes dropped EXE
PID:764 -
C:\Users\Admin\AppData\Local\Temp\C668.tmp"C:\Users\Admin\AppData\Local\Temp\C668.tmp"56⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"C:\Users\Admin\AppData\Local\Temp\C6E5.tmp"57⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\C752.tmp"C:\Users\Admin\AppData\Local\Temp\C752.tmp"58⤵
- Executes dropped EXE
PID:3760 -
C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"C:\Users\Admin\AppData\Local\Temp\C7CF.tmp"59⤵
- Executes dropped EXE
PID:3544 -
C:\Users\Admin\AppData\Local\Temp\C82D.tmp"C:\Users\Admin\AppData\Local\Temp\C82D.tmp"60⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\C89A.tmp"C:\Users\Admin\AppData\Local\Temp\C89A.tmp"61⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"C:\Users\Admin\AppData\Local\Temp\C8F8.tmp"62⤵
- Executes dropped EXE
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\C966.tmp"C:\Users\Admin\AppData\Local\Temp\C966.tmp"63⤵
- Executes dropped EXE
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"64⤵
- Executes dropped EXE
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\CA40.tmp"C:\Users\Admin\AppData\Local\Temp\CA40.tmp"65⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"C:\Users\Admin\AppData\Local\Temp\CA9E.tmp"66⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"C:\Users\Admin\AppData\Local\Temp\CB0B.tmp"67⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\CB79.tmp"C:\Users\Admin\AppData\Local\Temp\CB79.tmp"68⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"C:\Users\Admin\AppData\Local\Temp\CBE6.tmp"69⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\CC54.tmp"C:\Users\Admin\AppData\Local\Temp\CC54.tmp"70⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"C:\Users\Admin\AppData\Local\Temp\CCC1.tmp"71⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"C:\Users\Admin\AppData\Local\Temp\CD2E.tmp"72⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"C:\Users\Admin\AppData\Local\Temp\CD9C.tmp"73⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\CE19.tmp"C:\Users\Admin\AppData\Local\Temp\CE19.tmp"74⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\CE86.tmp"C:\Users\Admin\AppData\Local\Temp\CE86.tmp"75⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"C:\Users\Admin\AppData\Local\Temp\CEE4.tmp"76⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\CF51.tmp"C:\Users\Admin\AppData\Local\Temp\CF51.tmp"77⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"C:\Users\Admin\AppData\Local\Temp\CFBF.tmp"78⤵PID:1080
-
C:\Users\Admin\AppData\Local\Temp\D00D.tmp"C:\Users\Admin\AppData\Local\Temp\D00D.tmp"79⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\D08A.tmp"C:\Users\Admin\AppData\Local\Temp\D08A.tmp"80⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"C:\Users\Admin\AppData\Local\Temp\D0F7.tmp"81⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\D164.tmp"C:\Users\Admin\AppData\Local\Temp\D164.tmp"82⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"C:\Users\Admin\AppData\Local\Temp\D1E1.tmp"83⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\D23F.tmp"C:\Users\Admin\AppData\Local\Temp\D23F.tmp"84⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"C:\Users\Admin\AppData\Local\Temp\D2BC.tmp"85⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\D32A.tmp"C:\Users\Admin\AppData\Local\Temp\D32A.tmp"86⤵PID:3580
-
C:\Users\Admin\AppData\Local\Temp\D397.tmp"C:\Users\Admin\AppData\Local\Temp\D397.tmp"87⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\D404.tmp"C:\Users\Admin\AppData\Local\Temp\D404.tmp"88⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\D472.tmp"C:\Users\Admin\AppData\Local\Temp\D472.tmp"89⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"C:\Users\Admin\AppData\Local\Temp\D4CF.tmp"90⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\D51E.tmp"C:\Users\Admin\AppData\Local\Temp\D51E.tmp"91⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\D56C.tmp"C:\Users\Admin\AppData\Local\Temp\D56C.tmp"92⤵PID:4548
-
C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"C:\Users\Admin\AppData\Local\Temp\D5D9.tmp"93⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\D627.tmp"C:\Users\Admin\AppData\Local\Temp\D627.tmp"94⤵PID:2360
-
C:\Users\Admin\AppData\Local\Temp\D695.tmp"C:\Users\Admin\AppData\Local\Temp\D695.tmp"95⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"C:\Users\Admin\AppData\Local\Temp\D6F2.tmp"96⤵PID:3340
-
C:\Users\Admin\AppData\Local\Temp\D760.tmp"C:\Users\Admin\AppData\Local\Temp\D760.tmp"97⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"C:\Users\Admin\AppData\Local\Temp\D7DD.tmp"98⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\D84A.tmp"C:\Users\Admin\AppData\Local\Temp\D84A.tmp"99⤵PID:3576
-
C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"C:\Users\Admin\AppData\Local\Temp\D8B7.tmp"100⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\D925.tmp"C:\Users\Admin\AppData\Local\Temp\D925.tmp"101⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\D992.tmp"C:\Users\Admin\AppData\Local\Temp\D992.tmp"102⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\DA00.tmp"C:\Users\Admin\AppData\Local\Temp\DA00.tmp"103⤵PID:3600
-
C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"C:\Users\Admin\AppData\Local\Temp\DA6D.tmp"104⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\DADA.tmp"C:\Users\Admin\AppData\Local\Temp\DADA.tmp"105⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\DB38.tmp"C:\Users\Admin\AppData\Local\Temp\DB38.tmp"106⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"C:\Users\Admin\AppData\Local\Temp\DBA5.tmp"107⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\DC03.tmp"C:\Users\Admin\AppData\Local\Temp\DC03.tmp"108⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\DC71.tmp"C:\Users\Admin\AppData\Local\Temp\DC71.tmp"109⤵PID:2112
-
C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"C:\Users\Admin\AppData\Local\Temp\DCEE.tmp"110⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"C:\Users\Admin\AppData\Local\Temp\DD5B.tmp"111⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"C:\Users\Admin\AppData\Local\Temp\DDC8.tmp"112⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\DE26.tmp"C:\Users\Admin\AppData\Local\Temp\DE26.tmp"113⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\DE84.tmp"C:\Users\Admin\AppData\Local\Temp\DE84.tmp"114⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\DED2.tmp"C:\Users\Admin\AppData\Local\Temp\DED2.tmp"115⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\DF20.tmp"C:\Users\Admin\AppData\Local\Temp\DF20.tmp"116⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"C:\Users\Admin\AppData\Local\Temp\DF9D.tmp"117⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"C:\Users\Admin\AppData\Local\Temp\DFFB.tmp"118⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\E059.tmp"C:\Users\Admin\AppData\Local\Temp\E059.tmp"119⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"C:\Users\Admin\AppData\Local\Temp\E0A7.tmp"120⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\E104.tmp"C:\Users\Admin\AppData\Local\Temp\E104.tmp"121⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\E153.tmp"C:\Users\Admin\AppData\Local\Temp\E153.tmp"122⤵PID:4612
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-