Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
15/06/2024, 13:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
Resource
win10v2004-20240611-en
2 signatures
150 seconds
General
-
Target
2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe
-
Size
765KB
-
MD5
cc5c24a2afbfa0ca1c22fd9e2de627c4
-
SHA1
cd3cf423c2e8d751f92c14285d09b70714fb9ce1
-
SHA256
fda5db7b99d7d8c5131f35b11ae8626af626bc17bf3d19de3073b90e9c63c51a
-
SHA512
a2c4e7f99e4962103ae1f3963807a280069137254c8d66fc4e7f2f0624cf1a257c11c71edc36b0771eebb35eba6b4b87291d35c7a381ba126caabc1520f5c70b
-
SSDEEP
12288:ZU5rCOTeiD5kBjOTW4BlVDDYSxjA/EmUV3/Hjxwwy3ZF5rn5rLOa54U5w5A:ZUQOJDSmbl+SR+KDxwb3vh5Oa+UOS
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4640 3E80.tmp 1216 3EED.tmp 2064 3F7A.tmp 2780 4006.tmp 2116 4074.tmp 1300 40F1.tmp 2924 413F.tmp 2740 41BC.tmp 2024 4229.tmp 4920 4277.tmp 4120 42E5.tmp 3932 4352.tmp 3852 43C0.tmp 2948 444C.tmp 4436 44E8.tmp 3924 4585.tmp 1988 45F2.tmp 948 4650.tmp 4004 46DC.tmp 2404 474A.tmp 4348 47E6.tmp 1340 4853.tmp 516 48B1.tmp 3484 490F.tmp 1112 497C.tmp 2380 4A09.tmp 1624 4A76.tmp 4732 4AF3.tmp 4384 4B80.tmp 4404 4BED.tmp 2612 4C4B.tmp 3888 4CC8.tmp 4416 4D84.tmp 3828 4DE1.tmp 640 4E2F.tmp 4000 4E8D.tmp 3156 4EEB.tmp 1668 4F49.tmp 4880 4F97.tmp 4776 4FF5.tmp 2836 5043.tmp 3692 50A0.tmp 2216 50EF.tmp 4644 514C.tmp 4328 51BA.tmp 4600 5208.tmp 1804 5266.tmp 4640 52C3.tmp 1396 5311.tmp 4024 536F.tmp 860 53CD.tmp 4512 542B.tmp 3452 5479.tmp 220 54E6.tmp 1432 5544.tmp 1108 5592.tmp 1176 55F0.tmp 1548 564E.tmp 2080 56BB.tmp 2144 5728.tmp 1344 5786.tmp 3728 57D4.tmp 2024 5832.tmp 724 5890.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2904 wrote to memory of 4640 2904 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 81 PID 2904 wrote to memory of 4640 2904 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 81 PID 2904 wrote to memory of 4640 2904 2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe 81 PID 4640 wrote to memory of 1216 4640 3E80.tmp 83 PID 4640 wrote to memory of 1216 4640 3E80.tmp 83 PID 4640 wrote to memory of 1216 4640 3E80.tmp 83 PID 1216 wrote to memory of 2064 1216 3EED.tmp 84 PID 1216 wrote to memory of 2064 1216 3EED.tmp 84 PID 1216 wrote to memory of 2064 1216 3EED.tmp 84 PID 2064 wrote to memory of 2780 2064 3F7A.tmp 86 PID 2064 wrote to memory of 2780 2064 3F7A.tmp 86 PID 2064 wrote to memory of 2780 2064 3F7A.tmp 86 PID 2780 wrote to memory of 2116 2780 4006.tmp 88 PID 2780 wrote to memory of 2116 2780 4006.tmp 88 PID 2780 wrote to memory of 2116 2780 4006.tmp 88 PID 2116 wrote to memory of 1300 2116 4074.tmp 89 PID 2116 wrote to memory of 1300 2116 4074.tmp 89 PID 2116 wrote to memory of 1300 2116 4074.tmp 89 PID 1300 wrote to memory of 2924 1300 40F1.tmp 90 PID 1300 wrote to memory of 2924 1300 40F1.tmp 90 PID 1300 wrote to memory of 2924 1300 40F1.tmp 90 PID 2924 wrote to memory of 2740 2924 413F.tmp 91 PID 2924 wrote to memory of 2740 2924 413F.tmp 91 PID 2924 wrote to memory of 2740 2924 413F.tmp 91 PID 2740 wrote to memory of 2024 2740 41BC.tmp 92 PID 2740 wrote to memory of 2024 2740 41BC.tmp 92 PID 2740 wrote to memory of 2024 2740 41BC.tmp 92 PID 2024 wrote to memory of 4920 2024 4229.tmp 93 PID 2024 wrote to memory of 4920 2024 4229.tmp 93 PID 2024 wrote to memory of 4920 2024 4229.tmp 93 PID 4920 wrote to memory of 4120 4920 4277.tmp 94 PID 4920 wrote to memory of 4120 4920 4277.tmp 94 PID 4920 wrote to memory of 4120 4920 4277.tmp 94 PID 4120 wrote to memory of 3932 4120 42E5.tmp 95 PID 4120 wrote to memory of 3932 4120 42E5.tmp 95 PID 4120 wrote to memory of 3932 4120 42E5.tmp 95 PID 3932 wrote to memory of 3852 3932 4352.tmp 96 PID 3932 wrote to memory of 3852 3932 4352.tmp 96 PID 3932 wrote to memory of 3852 3932 4352.tmp 96 PID 3852 wrote to memory of 2948 3852 43C0.tmp 97 PID 3852 wrote to memory of 2948 3852 43C0.tmp 97 PID 3852 wrote to memory of 2948 3852 43C0.tmp 97 PID 2948 wrote to memory of 4436 2948 444C.tmp 98 PID 2948 wrote to memory of 4436 2948 444C.tmp 98 PID 2948 wrote to memory of 4436 2948 444C.tmp 98 PID 4436 wrote to memory of 3924 4436 44E8.tmp 99 PID 4436 wrote to memory of 3924 4436 44E8.tmp 99 PID 4436 wrote to memory of 3924 4436 44E8.tmp 99 PID 3924 wrote to memory of 1988 3924 4585.tmp 100 PID 3924 wrote to memory of 1988 3924 4585.tmp 100 PID 3924 wrote to memory of 1988 3924 4585.tmp 100 PID 1988 wrote to memory of 948 1988 45F2.tmp 101 PID 1988 wrote to memory of 948 1988 45F2.tmp 101 PID 1988 wrote to memory of 948 1988 45F2.tmp 101 PID 948 wrote to memory of 4004 948 4650.tmp 102 PID 948 wrote to memory of 4004 948 4650.tmp 102 PID 948 wrote to memory of 4004 948 4650.tmp 102 PID 4004 wrote to memory of 2404 4004 46DC.tmp 103 PID 4004 wrote to memory of 2404 4004 46DC.tmp 103 PID 4004 wrote to memory of 2404 4004 46DC.tmp 103 PID 2404 wrote to memory of 4348 2404 474A.tmp 104 PID 2404 wrote to memory of 4348 2404 474A.tmp 104 PID 2404 wrote to memory of 4348 2404 474A.tmp 104 PID 4348 wrote to memory of 1340 4348 47E6.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_cc5c24a2afbfa0ca1c22fd9e2de627c4_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\3E80.tmp"C:\Users\Admin\AppData\Local\Temp\3E80.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"C:\Users\Admin\AppData\Local\Temp\3F7A.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\4006.tmp"C:\Users\Admin\AppData\Local\Temp\4006.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\4074.tmp"C:\Users\Admin\AppData\Local\Temp\4074.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\40F1.tmp"C:\Users\Admin\AppData\Local\Temp\40F1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\413F.tmp"C:\Users\Admin\AppData\Local\Temp\413F.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Users\Admin\AppData\Local\Temp\41BC.tmp"C:\Users\Admin\AppData\Local\Temp\41BC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\42E5.tmp"C:\Users\Admin\AppData\Local\Temp\42E5.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\43C0.tmp"C:\Users\Admin\AppData\Local\Temp\43C0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\44E8.tmp"C:\Users\Admin\AppData\Local\Temp\44E8.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\45F2.tmp"C:\Users\Admin\AppData\Local\Temp\45F2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\Temp\46DC.tmp"C:\Users\Admin\AppData\Local\Temp\46DC.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\474A.tmp"C:\Users\Admin\AppData\Local\Temp\474A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\47E6.tmp"C:\Users\Admin\AppData\Local\Temp\47E6.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\4853.tmp"C:\Users\Admin\AppData\Local\Temp\4853.tmp"23⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"24⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"25⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\497C.tmp"C:\Users\Admin\AppData\Local\Temp\497C.tmp"26⤵
- Executes dropped EXE
PID:1112 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"27⤵
- Executes dropped EXE
PID:2380 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"28⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"C:\Users\Admin\AppData\Local\Temp\4AF3.tmp"29⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"30⤵
- Executes dropped EXE
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"31⤵
- Executes dropped EXE
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"32⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"C:\Users\Admin\AppData\Local\Temp\4CC8.tmp"33⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"34⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"35⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"36⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"37⤵
- Executes dropped EXE
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"38⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"39⤵
- Executes dropped EXE
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\4F97.tmp"C:\Users\Admin\AppData\Local\Temp\4F97.tmp"40⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"C:\Users\Admin\AppData\Local\Temp\4FF5.tmp"41⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\5043.tmp"C:\Users\Admin\AppData\Local\Temp\5043.tmp"42⤵
- Executes dropped EXE
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"43⤵
- Executes dropped EXE
PID:3692 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"44⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"45⤵
- Executes dropped EXE
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"46⤵
- Executes dropped EXE
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"47⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"48⤵
- Executes dropped EXE
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"49⤵
- Executes dropped EXE
PID:4640 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"50⤵
- Executes dropped EXE
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"51⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"52⤵
- Executes dropped EXE
PID:860 -
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"53⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\5479.tmp"C:\Users\Admin\AppData\Local\Temp\5479.tmp"54⤵
- Executes dropped EXE
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"55⤵
- Executes dropped EXE
PID:220 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"56⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"57⤵
- Executes dropped EXE
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\55F0.tmp"C:\Users\Admin\AppData\Local\Temp\55F0.tmp"58⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\564E.tmp"C:\Users\Admin\AppData\Local\Temp\564E.tmp"59⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"60⤵
- Executes dropped EXE
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"61⤵
- Executes dropped EXE
PID:2144 -
C:\Users\Admin\AppData\Local\Temp\5786.tmp"C:\Users\Admin\AppData\Local\Temp\5786.tmp"62⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"63⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\5832.tmp"C:\Users\Admin\AppData\Local\Temp\5832.tmp"64⤵
- Executes dropped EXE
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"65⤵
- Executes dropped EXE
PID:724 -
C:\Users\Admin\AppData\Local\Temp\58ED.tmp"C:\Users\Admin\AppData\Local\Temp\58ED.tmp"66⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"67⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"68⤵PID:872
-
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"69⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"70⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"71⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"72⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"73⤵PID:5056
-
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"74⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"C:\Users\Admin\AppData\Local\Temp\5BFB.tmp"75⤵PID:4464
-
C:\Users\Admin\AppData\Local\Temp\5C58.tmp"C:\Users\Admin\AppData\Local\Temp\5C58.tmp"76⤵PID:1400
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"77⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"78⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"79⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"80⤵PID:3208
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"81⤵PID:3288
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"82⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"83⤵PID:2188
-
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"84⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\5F95.tmp"C:\Users\Admin\AppData\Local\Temp\5F95.tmp"85⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"86⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"87⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"88⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"89⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"90⤵PID:4732
-
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"91⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\61E6.tmp"C:\Users\Admin\AppData\Local\Temp\61E6.tmp"92⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"93⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"94⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"95⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"96⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\638C.tmp"C:\Users\Admin\AppData\Local\Temp\638C.tmp"97⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\63EA.tmp"C:\Users\Admin\AppData\Local\Temp\63EA.tmp"98⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\6438.tmp"C:\Users\Admin\AppData\Local\Temp\6438.tmp"99⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"100⤵PID:3812
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"101⤵PID:2088
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"102⤵PID:3828
-
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"103⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\65EE.tmp"C:\Users\Admin\AppData\Local\Temp\65EE.tmp"104⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"105⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"106⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"107⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"108⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"109⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"110⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\685F.tmp"C:\Users\Admin\AppData\Local\Temp\685F.tmp"111⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"112⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"113⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"114⤵PID:4600
-
C:\Users\Admin\AppData\Local\Temp\69B6.tmp"C:\Users\Admin\AppData\Local\Temp\69B6.tmp"115⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"116⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"117⤵PID:4252
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"118⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"119⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"120⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"121⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"122⤵PID:2780
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-