Analysis
- max time kernel
150s - max time network
101s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system - submitted
03/06/2024, 18:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe
Resource
win7-20240508-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
- Target 2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe
- Size 536KB
- Sample240603-wl7wksec4y
- SHA256 f98f35ff4b63337ae08c209a6799a23d59875ca6c157a869b17a05e0d9c4e472
- MD5 5ae1f2b6fe97c13577f81eedc253f497
- SHA1 add15f814a87b7ecddf4026076c3802ee19c13a5
- SHA512 6e12654a60b7e7cf0cd7a9701d46552522f07c36f31a10d0ee36e2f53f16a20611efbb020849a192f696f7a65cb4b49f2244ab11e52fe3bfe6adf1301bd41f88
- SSDEEP 12288:wU5rCOTeiUZ1pYw/4UJRKfMvq7NenL0b90rg6sIZxVJ0ZT9:wUQOJUfaw/3wfMuNKLSWsIRJ0ZT9
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 64 IoCs
pid Process 2408 3D09.tmp 2212 3DD4.tmp 3932 3EAF.tmp 3684 3F99.tmp 4828 4045.tmp 1216 4120.tmp 1564 41CC.tmp 4992 4258.tmp 3492 4304.tmp 1572 4391.tmp 796 443D.tmp 2024 44BA.tmp 4004 4575.tmp 3268 45F2.tmp 1812 468E.tmp 3040 474A.tmp 376 47F6.tmp 4612 4873.tmp 3484 492E.tmp 4492 49BB.tmp 5092 4A67.tmp 1076 4AC4.tmp 4964 4BAF.tmp 4456 4C5B.tmp 3060 4D16.tmp 2352 4DC2.tmp 1880 4E3F.tmp 3312 4EDB.tmp 1908 4F78.tmp 980 5043.tmp 5004 50C0.tmp 4592 513D.tmp 3560 51E9.tmp 4008 5237.tmp 628 5294.tmp 4508 52E3.tmp 2708 5350.tmp 4088 53AE.tmp 1544 541B.tmp 4256 5488.tmp 3556 54E6.tmp 1812 5544.tmp 4604 55B1.tmp 4568 560F.tmp 2304 56AB.tmp 5116 5709.tmp 2088 5786.tmp 1956 57F3.tmp 2556 5851.tmp 4924 589F.tmp 3508 58ED.tmp 4448 593C.tmp 1972 598A.tmp 1008 59D8.tmp 3108 5A26.tmp 1984 5A74.tmp 1676 5AC2.tmp 3012 5B20.tmp 4512 5B6E.tmp 4656 5BBC.tmp 4576 5C0A.tmp 2420 5C68.tmp 3932 5CB6.tmp 3816 5D14.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1012 wrote to memory of 2408 1012 2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe 82 PID 1012 wrote to memory of 2408 1012 2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe 82 PID 1012 wrote to memory of 2408 1012 2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe 82 PID 2408 wrote to memory of 2212 2408 3D09.tmp 83 PID 2408 wrote to memory of 2212 2408 3D09.tmp 83 PID 2408 wrote to memory of 2212 2408 3D09.tmp 83 PID 2212 wrote to memory of 3932 2212 3DD4.tmp 84 PID 2212 wrote to memory of 3932 2212 3DD4.tmp 84 PID 2212 wrote to memory of 3932 2212 3DD4.tmp 84 PID 3932 wrote to memory of 3684 3932 3EAF.tmp 86 PID 3932 wrote to memory of 3684 3932 3EAF.tmp 86 PID 3932 wrote to memory of 3684 3932 3EAF.tmp 86 PID 3684 wrote to memory of 4828 3684 3F99.tmp 88 PID 3684 wrote to memory of 4828 3684 3F99.tmp 88 PID 3684 wrote to memory of 4828 3684 3F99.tmp 88 PID 4828 wrote to memory of 1216 4828 4045.tmp 89 PID 4828 wrote to memory of 1216 4828 4045.tmp 89 PID 4828 wrote to memory of 1216 4828 4045.tmp 89 PID 1216 wrote to memory of 1564 1216 4120.tmp 91 PID 1216 wrote to memory of 1564 1216 4120.tmp 91 PID 1216 wrote to memory of 1564 1216 4120.tmp 91 PID 1564 wrote to memory of 4992 1564 41CC.tmp 92 PID 1564 wrote to memory of 4992 1564 41CC.tmp 92 PID 1564 wrote to memory of 4992 1564 41CC.tmp 92 PID 4992 wrote to memory of 3492 4992 4258.tmp 93 PID 4992 wrote to memory of 3492 4992 4258.tmp 93 PID 4992 wrote to memory of 3492 4992 4258.tmp 93 PID 3492 wrote to memory of 1572 3492 4304.tmp 94 PID 3492 wrote to memory of 1572 3492 4304.tmp 94 PID 3492 wrote to memory of 1572 3492 4304.tmp 94 PID 1572 wrote to memory of 796 1572 4391.tmp 95 PID 1572 wrote to memory of 796 1572 4391.tmp 95 PID 1572 wrote to memory of 796 1572 4391.tmp 95 PID 796 wrote to memory of 2024 796 443D.tmp 96 PID 796 wrote to memory of 2024 796 443D.tmp 96 PID 796 wrote to memory of 2024 796 443D.tmp 96 PID 2024 wrote to memory of 4004 2024 44BA.tmp 97 PID 2024 wrote to memory of 4004 2024 44BA.tmp 97 PID 2024 wrote to memory of 4004 2024 44BA.tmp 97 PID 4004 wrote to memory of 3268 4004 4575.tmp 98 PID 4004 wrote to memory of 3268 4004 4575.tmp 98 PID 4004 wrote to memory of 3268 4004 4575.tmp 98 PID 3268 wrote to memory of 1812 3268 45F2.tmp 99 PID 3268 wrote to memory of 1812 3268 45F2.tmp 99 PID 3268 wrote to memory of 1812 3268 45F2.tmp 99 PID 1812 wrote to memory of 3040 1812 468E.tmp 100 PID 1812 wrote to memory of 3040 1812 468E.tmp 100 PID 1812 wrote to memory of 3040 1812 468E.tmp 100 PID 3040 wrote to memory of 376 3040 474A.tmp 101 PID 3040 wrote to memory of 376 3040 474A.tmp 101 PID 3040 wrote to memory of 376 3040 474A.tmp 101 PID 376 wrote to memory of 4612 376 47F6.tmp 102 PID 376 wrote to memory of 4612 376 47F6.tmp 102 PID 376 wrote to memory of 4612 376 47F6.tmp 102 PID 4612 wrote to memory of 3484 4612 4873.tmp 104 PID 4612 wrote to memory of 3484 4612 4873.tmp 104 PID 4612 wrote to memory of 3484 4612 4873.tmp 104 PID 3484 wrote to memory of 4492 3484 492E.tmp 105 PID 3484 wrote to memory of 4492 3484 492E.tmp 105 PID 3484 wrote to memory of 4492 3484 492E.tmp 105 PID 4492 wrote to memory of 5092 4492 49BB.tmp 106 PID 4492 wrote to memory of 5092 4492 49BB.tmp 106 PID 4492 wrote to memory of 5092 4492 49BB.tmp 106 PID 5092 wrote to memory of 1076 5092 4A67.tmp 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_5ae1f2b6fe97c13577f81eedc253f497_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\3D09.tmp"C:\Users\Admin\AppData\Local\Temp\3D09.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"C:\Users\Admin\AppData\Local\Temp\3DD4.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"C:\Users\Admin\AppData\Local\Temp\3EAF.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\3F99.tmp"C:\Users\Admin\AppData\Local\Temp\3F99.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\4045.tmp"C:\Users\Admin\AppData\Local\Temp\4045.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4828 -
C:\Users\Admin\AppData\Local\Temp\4120.tmp"C:\Users\Admin\AppData\Local\Temp\4120.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\4258.tmp"C:\Users\Admin\AppData\Local\Temp\4258.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\4304.tmp"C:\Users\Admin\AppData\Local\Temp\4304.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\47F6.tmp"C:\Users\Admin\AppData\Local\Temp\47F6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4873.tmp"C:\Users\Admin\AppData\Local\Temp\4873.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Users\Admin\AppData\Local\Temp\492E.tmp"C:\Users\Admin\AppData\Local\Temp\492E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"23⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"24⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"25⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\4D16.tmp"C:\Users\Admin\AppData\Local\Temp\4D16.tmp"26⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"27⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"28⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"C:\Users\Admin\AppData\Local\Temp\4EDB.tmp"29⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\4F78.tmp"C:\Users\Admin\AppData\Local\Temp\4F78.tmp"30⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"31⤵
- Executes dropped EXE
PID:980 -
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"32⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"33⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"34⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"35⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\5294.tmp"C:\Users\Admin\AppData\Local\Temp\5294.tmp"36⤵
- Executes dropped EXE
PID:628 -
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"37⤵
- Executes dropped EXE
PID:4508 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"38⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"39⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"40⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"41⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"42⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"43⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\55B1.tmp"C:\Users\Admin\AppData\Local\Temp\55B1.tmp"44⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"45⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"46⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"47⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"48⤵
- Executes dropped EXE
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"49⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\5851.tmp"C:\Users\Admin\AppData\Local\Temp\5851.tmp"50⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\589F.tmp"C:\Users\Admin\AppData\Local\Temp\589F.tmp"51⤵
- Executes dropped EXE
PID:4924 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"52⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"53⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"54⤵
- Executes dropped EXE
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"55⤵
- Executes dropped EXE
PID:1008 -
C:\Users\Admin\AppData\Local\Temp\5A26.tmp"C:\Users\Admin\AppData\Local\Temp\5A26.tmp"56⤵
- Executes dropped EXE
PID:3108 -
C:\Users\Admin\AppData\Local\Temp\5A74.tmp"C:\Users\Admin\AppData\Local\Temp\5A74.tmp"57⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"58⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"59⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"60⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"C:\Users\Admin\AppData\Local\Temp\5BBC.tmp"61⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"62⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"63⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"64⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"65⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"66⤵PID:1376
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"67⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"68⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"69⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"70⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"71⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"72⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"73⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"74⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\606F.tmp"C:\Users\Admin\AppData\Local\Temp\606F.tmp"75⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"76⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"77⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\6169.tmp"C:\Users\Admin\AppData\Local\Temp\6169.tmp"78⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"79⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"80⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\6263.tmp"C:\Users\Admin\AppData\Local\Temp\6263.tmp"81⤵PID:1188
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"82⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"83⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\634E.tmp"C:\Users\Admin\AppData\Local\Temp\634E.tmp"84⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\639C.tmp"C:\Users\Admin\AppData\Local\Temp\639C.tmp"85⤵PID:5116
-
C:\Users\Admin\AppData\Local\Temp\63FA.tmp"C:\Users\Admin\AppData\Local\Temp\63FA.tmp"86⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\6448.tmp"C:\Users\Admin\AppData\Local\Temp\6448.tmp"87⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"88⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\64F4.tmp"C:\Users\Admin\AppData\Local\Temp\64F4.tmp"89⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\6542.tmp"C:\Users\Admin\AppData\Local\Temp\6542.tmp"90⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"91⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"92⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"93⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"94⤵PID:3108
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"95⤵PID:316
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"96⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"97⤵PID:3452
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"98⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"99⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"100⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"101⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"102⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"103⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\6997.tmp"C:\Users\Admin\AppData\Local\Temp\6997.tmp"104⤵PID:628
-
C:\Users\Admin\AppData\Local\Temp\69F5.tmp"C:\Users\Admin\AppData\Local\Temp\69F5.tmp"105⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\6A53.tmp"C:\Users\Admin\AppData\Local\Temp\6A53.tmp"106⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"107⤵PID:4832
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"108⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"109⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"110⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"111⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"112⤵PID:3308
-
C:\Users\Admin\AppData\Local\Temp\6C85.tmp"C:\Users\Admin\AppData\Local\Temp\6C85.tmp"113⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"C:\Users\Admin\AppData\Local\Temp\6CD3.tmp"114⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"115⤵PID:4216
-
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"116⤵PID:3320
-
C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"C:\Users\Admin\AppData\Local\Temp\6DCD.tmp"117⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"118⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"119⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"120⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"121⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\6F54.tmp"C:\Users\Admin\AppData\Local\Temp\6F54.tmp"122⤵PID:5016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-