Analysis
- max time kernel
150s - max time network
55s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
13/06/2024, 01:36
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe
- Size 520KB
- Sample240613-b1ne9stank
- SHA256 546af5715ba9ffd1e1ab9dc8a152fec6d740982fb0e7cd4d8ef0c1addfff125b
- MD5 8805cd4ef7a0ae483eeafc6051d1da47
- SHA1 e3cdc0fb0d2d39cd6421163cdeb22e4b77993f2d
- SHA512 60ffa485b2cc580147c0753b6daff6c352f89a4fce42dc43eba9e6448c48aef57d196bb0b84701c4389219ebc4d5c1e484f8e95a3c17d3a9f2a70933fe37649c
- SSDEEP 12288:gj8fuxR21t5i8fRioxnMBoRnoPQaFk30h6pxb1Z/iPNZ:gj8fuK1GYdMBoRoPsvVZAN
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 3896 3BE0.tmp 3312 3C7C.tmp 4780 3CF9.tmp 3488 3D76.tmp 1960 3DE4.tmp 3816 3E41.tmp 792 3E9F.tmp 2180 3F1C.tmp 1300 3F99.tmp 1832 3FE7.tmp 668 4064.tmp 2112 40B2.tmp 4260 4100.tmp 5096 417D.tmp 4532 420A.tmp 432 4277.tmp 3560 42C6.tmp 1312 4343.tmp 4500 43B0.tmp 1304 441D.tmp 4384 447B.tmp 4948 44E8.tmp 4340 4565.tmp 4428 45E2.tmp 4088 4650.tmp 3268 46AE.tmp 1872 472B.tmp 3876 4788.tmp 3556 47E6.tmp 1156 4853.tmp 4584 48C1.tmp 4612 492E.tmp 3320 498C.tmp 3732 49DA.tmp 2188 4A28.tmp 1464 4A76.tmp 4600 4AC4.tmp 2560 4B13.tmp 3392 4B61.tmp 4876 4BAF.tmp 4668 4C0D.tmp 4844 4C6A.tmp 5024 4CB8.tmp 2396 4D16.tmp 4448 4D64.tmp 1308 4DB2.tmp 4380 4E10.tmp 4988 4E5E.tmp 4776 4EAC.tmp 3144 4F0A.tmp 4040 4F58.tmp 2336 4FB6.tmp 4796 5004.tmp 1984 5052.tmp 4332 50A0.tmp 2372 50FE.tmp 2072 514C.tmp 2280 51AA.tmp 5112 51F8.tmp 2552 5246.tmp 3312 5294.tmp 4656 52E3.tmp 4780 5331.tmp 1524 538E.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 3896 1496 2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe 81 PID 1496 wrote to memory of 3896 1496 2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe 81 PID 1496 wrote to memory of 3896 1496 2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe 81 PID 3896 wrote to memory of 3312 3896 3BE0.tmp 84 PID 3896 wrote to memory of 3312 3896 3BE0.tmp 84 PID 3896 wrote to memory of 3312 3896 3BE0.tmp 84 PID 3312 wrote to memory of 4780 3312 3C7C.tmp 86 PID 3312 wrote to memory of 4780 3312 3C7C.tmp 86 PID 3312 wrote to memory of 4780 3312 3C7C.tmp 86 PID 4780 wrote to memory of 3488 4780 3CF9.tmp 87 PID 4780 wrote to memory of 3488 4780 3CF9.tmp 87 PID 4780 wrote to memory of 3488 4780 3CF9.tmp 87 PID 3488 wrote to memory of 1960 3488 3D76.tmp 88 PID 3488 wrote to memory of 1960 3488 3D76.tmp 88 PID 3488 wrote to memory of 1960 3488 3D76.tmp 88 PID 1960 wrote to memory of 3816 1960 3DE4.tmp 89 PID 1960 wrote to memory of 3816 1960 3DE4.tmp 89 PID 1960 wrote to memory of 3816 1960 3DE4.tmp 89 PID 3816 wrote to memory of 792 3816 3E41.tmp 90 PID 3816 wrote to memory of 792 3816 3E41.tmp 90 PID 3816 wrote to memory of 792 3816 3E41.tmp 90 PID 792 wrote to memory of 2180 792 3E9F.tmp 91 PID 792 wrote to memory of 2180 792 3E9F.tmp 91 PID 792 wrote to memory of 2180 792 3E9F.tmp 91 PID 2180 wrote to memory of 1300 2180 3F1C.tmp 92 PID 2180 wrote to memory of 1300 2180 3F1C.tmp 92 PID 2180 wrote to memory of 1300 2180 3F1C.tmp 92 PID 1300 wrote to memory of 1832 1300 3F99.tmp 93 PID 1300 wrote to memory of 1832 1300 3F99.tmp 93 PID 1300 wrote to memory of 1832 1300 3F99.tmp 93 PID 1832 wrote to memory of 668 1832 3FE7.tmp 94 PID 1832 wrote to memory of 668 1832 3FE7.tmp 94 PID 1832 wrote to memory of 668 1832 3FE7.tmp 94 PID 668 wrote to memory of 2112 668 4064.tmp 95 PID 668 wrote to memory of 2112 668 4064.tmp 95 PID 668 wrote to memory of 2112 668 4064.tmp 95 PID 2112 wrote to memory of 4260 2112 40B2.tmp 96 PID 2112 wrote to memory of 4260 2112 40B2.tmp 96 PID 2112 wrote to memory of 4260 2112 40B2.tmp 96 PID 4260 wrote to memory of 5096 4260 4100.tmp 97 PID 4260 wrote to memory of 5096 4260 4100.tmp 97 PID 4260 wrote to memory of 5096 4260 4100.tmp 97 PID 5096 wrote to memory of 4532 5096 417D.tmp 98 PID 5096 wrote to memory of 4532 5096 417D.tmp 98 PID 5096 wrote to memory of 4532 5096 417D.tmp 98 PID 4532 wrote to memory of 432 4532 420A.tmp 99 PID 4532 wrote to memory of 432 4532 420A.tmp 99 PID 4532 wrote to memory of 432 4532 420A.tmp 99 PID 432 wrote to memory of 3560 432 4277.tmp 100 PID 432 wrote to memory of 3560 432 4277.tmp 100 PID 432 wrote to memory of 3560 432 4277.tmp 100 PID 3560 wrote to memory of 1312 3560 42C6.tmp 101 PID 3560 wrote to memory of 1312 3560 42C6.tmp 101 PID 3560 wrote to memory of 1312 3560 42C6.tmp 101 PID 1312 wrote to memory of 4500 1312 4343.tmp 102 PID 1312 wrote to memory of 4500 1312 4343.tmp 102 PID 1312 wrote to memory of 4500 1312 4343.tmp 102 PID 4500 wrote to memory of 1304 4500 43B0.tmp 103 PID 4500 wrote to memory of 1304 4500 43B0.tmp 103 PID 4500 wrote to memory of 1304 4500 43B0.tmp 103 PID 1304 wrote to memory of 4384 1304 441D.tmp 104 PID 1304 wrote to memory of 4384 1304 441D.tmp 104 PID 1304 wrote to memory of 4384 1304 441D.tmp 104 PID 4384 wrote to memory of 4948 4384 447B.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-13_8805cd4ef7a0ae483eeafc6051d1da47_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"C:\Users\Admin\AppData\Local\Temp\3BE0.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"C:\Users\Admin\AppData\Local\Temp\3C7C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\3D76.tmp"C:\Users\Admin\AppData\Local\Temp\3D76.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"C:\Users\Admin\AppData\Local\Temp\3DE4.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\3E41.tmp"C:\Users\Admin\AppData\Local\Temp\3E41.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"C:\Users\Admin\AppData\Local\Temp\3F1C.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"C:\Users\Admin\AppData\Local\Temp\3FE7.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\4064.tmp"C:\Users\Admin\AppData\Local\Temp\4064.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Users\Admin\AppData\Local\Temp\40B2.tmp"C:\Users\Admin\AppData\Local\Temp\40B2.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\4100.tmp"C:\Users\Admin\AppData\Local\Temp\4100.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\420A.tmp"C:\Users\Admin\AppData\Local\Temp\420A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4500 -
C:\Users\Admin\AppData\Local\Temp\441D.tmp"C:\Users\Admin\AppData\Local\Temp\441D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"23⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\4565.tmp"C:\Users\Admin\AppData\Local\Temp\4565.tmp"24⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"25⤵
- Executes dropped EXE
PID:4428 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"26⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"27⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"28⤵
- Executes dropped EXE
PID:1872 -
C:\Users\Admin\AppData\Local\Temp\4788.tmp"C:\Users\Admin\AppData\Local\Temp\4788.tmp"29⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"30⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"31⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\48C1.tmp"C:\Users\Admin\AppData\Local\Temp\48C1.tmp"32⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"33⤵
- Executes dropped EXE
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"34⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\49DA.tmp"C:\Users\Admin\AppData\Local\Temp\49DA.tmp"35⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"36⤵
- Executes dropped EXE
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"37⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"38⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"39⤵
- Executes dropped EXE
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\4B61.tmp"C:\Users\Admin\AppData\Local\Temp\4B61.tmp"40⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"41⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"C:\Users\Admin\AppData\Local\Temp\4C0D.tmp"42⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"43⤵
- Executes dropped EXE
PID:4844 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"44⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"45⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"46⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"C:\Users\Admin\AppData\Local\Temp\4DB2.tmp"47⤵
- Executes dropped EXE
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"48⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"49⤵
- Executes dropped EXE
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"C:\Users\Admin\AppData\Local\Temp\4EAC.tmp"50⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"C:\Users\Admin\AppData\Local\Temp\4F0A.tmp"51⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"52⤵
- Executes dropped EXE
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"C:\Users\Admin\AppData\Local\Temp\4FB6.tmp"53⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"54⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"55⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"56⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\50FE.tmp"C:\Users\Admin\AppData\Local\Temp\50FE.tmp"57⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"58⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"59⤵
- Executes dropped EXE
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\51F8.tmp"C:\Users\Admin\AppData\Local\Temp\51F8.tmp"60⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\5246.tmp"C:\Users\Admin\AppData\Local\Temp\5246.tmp"61⤵
- Executes dropped EXE
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"62⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"63⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5331.tmp"C:\Users\Admin\AppData\Local\Temp\5331.tmp"64⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"65⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"66⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"67⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"68⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"69⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"70⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"71⤵PID:792
-
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"72⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"73⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"74⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"75⤵PID:2548
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"76⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"77⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"78⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"79⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"80⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"81⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\590D.tmp"C:\Users\Admin\AppData\Local\Temp\590D.tmp"82⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"83⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\59B9.tmp"C:\Users\Admin\AppData\Local\Temp\59B9.tmp"84⤵PID:1168
-
C:\Users\Admin\AppData\Local\Temp\5A07.tmp"C:\Users\Admin\AppData\Local\Temp\5A07.tmp"85⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"86⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"87⤵PID:3032
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"88⤵PID:1304
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"89⤵PID:796
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"90⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"91⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\5C49.tmp"C:\Users\Admin\AppData\Local\Temp\5C49.tmp"92⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\5C97.tmp"C:\Users\Admin\AppData\Local\Temp\5C97.tmp"93⤵PID:1448
-
C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"C:\Users\Admin\AppData\Local\Temp\5CF5.tmp"94⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\5D43.tmp"C:\Users\Admin\AppData\Local\Temp\5D43.tmp"95⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\5D91.tmp"C:\Users\Admin\AppData\Local\Temp\5D91.tmp"96⤵PID:3268
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"97⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"98⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"99⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"100⤵PID:3556
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"101⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"102⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"103⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"104⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"105⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"106⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"107⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"108⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"109⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"110⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"111⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"112⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"113⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"114⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"115⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"116⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"117⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"118⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"119⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\6571.tmp"C:\Users\Admin\AppData\Local\Temp\6571.tmp"120⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\65CE.tmp"C:\Users\Admin\AppData\Local\Temp\65CE.tmp"121⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\661C.tmp"C:\Users\Admin\AppData\Local\Temp\661C.tmp"122⤵PID:1424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-