Analysis
-
max time kernel
151s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 03:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe
-
Size
486KB
-
MD5
81f12befd2efc48d98856eecb1deb10f
-
SHA1
9c1cc6faedfa9ceda7b7f2a59aa713255f5ec878
-
SHA256
b26ab2e7abf5fafb462de8ff10e8b59d0c50482b4df34a2d505143d2276e6bf3
-
SHA512
26804144f83d573477d187285609a7caf6367fefd1c85f2f685c9eb047ce99c7a7e1a2865e95cfcadf442a1e15274a35f35da9f4f820ba9f390d7a0c2842c15f
-
SSDEEP
12288:/U5rCOTeiDSnyrpZ3HZOVAmiOI+2gmNZ:/UQOJDSnmpZ3YSOI+2pN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1776 DCC3.tmp 1948 DDFC.tmp 4980 DEB7.tmp 4268 DFB1.tmp 4012 E06D.tmp 3480 E0FA.tmp 1272 E196.tmp 1556 E213.tmp 1516 E290.tmp 3508 E32C.tmp 1004 E3B9.tmp 5000 E436.tmp 3336 E501.tmp 4168 E55F.tmp 952 E61A.tmp 3080 E6B6.tmp 4712 E733.tmp 3720 E7C0.tmp 3372 E85C.tmp 3952 E908.tmp 4476 E9C4.tmp 1956 EA41.tmp 4660 EB0C.tmp 1576 EBA8.tmp 1852 EC25.tmp 3256 ECC1.tmp 4876 ED9C.tmp 1324 EEA6.tmp 1664 EF42.tmp 840 EFDE.tmp 2220 F06B.tmp 4060 F0F7.tmp 4864 F174.tmp 1452 F201.tmp 4868 F28E.tmp 4804 F2EB.tmp 1020 F349.tmp 3468 F3B6.tmp 4748 F4D0.tmp 1344 F52D.tmp 4580 F59B.tmp 5100 F618.tmp 2264 F685.tmp 3424 F6E3.tmp 3600 F750.tmp 4852 F7AE.tmp 4188 F81B.tmp 664 F889.tmp 4212 F8F6.tmp 3480 F992.tmp 3192 FA0F.tmp 3936 FAEA.tmp 4232 FB96.tmp 4560 FC32.tmp 1516 FCFD.tmp 2444 FDB9.tmp 2384 FE55.tmp 3160 FF20.tmp 3672 FFDC.tmp 4808 78.tmp 4584 134.tmp 1076 1DF.tmp 1432 28B.tmp 3080 366.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1848 wrote to memory of 1776 1848 2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe 90 PID 1848 wrote to memory of 1776 1848 2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe 90 PID 1848 wrote to memory of 1776 1848 2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe 90 PID 1776 wrote to memory of 1948 1776 DCC3.tmp 91 PID 1776 wrote to memory of 1948 1776 DCC3.tmp 91 PID 1776 wrote to memory of 1948 1776 DCC3.tmp 91 PID 1948 wrote to memory of 4980 1948 DDFC.tmp 92 PID 1948 wrote to memory of 4980 1948 DDFC.tmp 92 PID 1948 wrote to memory of 4980 1948 DDFC.tmp 92 PID 4980 wrote to memory of 4268 4980 DEB7.tmp 93 PID 4980 wrote to memory of 4268 4980 DEB7.tmp 93 PID 4980 wrote to memory of 4268 4980 DEB7.tmp 93 PID 4268 wrote to memory of 4012 4268 DFB1.tmp 94 PID 4268 wrote to memory of 4012 4268 DFB1.tmp 94 PID 4268 wrote to memory of 4012 4268 DFB1.tmp 94 PID 4012 wrote to memory of 3480 4012 E06D.tmp 95 PID 4012 wrote to memory of 3480 4012 E06D.tmp 95 PID 4012 wrote to memory of 3480 4012 E06D.tmp 95 PID 3480 wrote to memory of 1272 3480 E0FA.tmp 96 PID 3480 wrote to memory of 1272 3480 E0FA.tmp 96 PID 3480 wrote to memory of 1272 3480 E0FA.tmp 96 PID 1272 wrote to memory of 1556 1272 E196.tmp 97 PID 1272 wrote to memory of 1556 1272 E196.tmp 97 PID 1272 wrote to memory of 1556 1272 E196.tmp 97 PID 1556 wrote to memory of 1516 1556 E213.tmp 98 PID 1556 wrote to memory of 1516 1556 E213.tmp 98 PID 1556 wrote to memory of 1516 1556 E213.tmp 98 PID 1516 wrote to memory of 3508 1516 E290.tmp 99 PID 1516 wrote to memory of 3508 1516 E290.tmp 99 PID 1516 wrote to memory of 3508 1516 E290.tmp 99 PID 3508 wrote to memory of 1004 3508 E32C.tmp 100 PID 3508 wrote to memory of 1004 3508 E32C.tmp 100 PID 3508 wrote to memory of 1004 3508 E32C.tmp 100 PID 1004 wrote to memory of 5000 1004 E3B9.tmp 101 PID 1004 wrote to memory of 5000 1004 E3B9.tmp 101 PID 1004 wrote to memory of 5000 1004 E3B9.tmp 101 PID 5000 wrote to memory of 3336 5000 E436.tmp 102 PID 5000 wrote to memory of 3336 5000 E436.tmp 102 PID 5000 wrote to memory of 3336 5000 E436.tmp 102 PID 3336 wrote to memory of 4168 3336 E501.tmp 103 PID 3336 wrote to memory of 4168 3336 E501.tmp 103 PID 3336 wrote to memory of 4168 3336 E501.tmp 103 PID 4168 wrote to memory of 952 4168 E55F.tmp 104 PID 4168 wrote to memory of 952 4168 E55F.tmp 104 PID 4168 wrote to memory of 952 4168 E55F.tmp 104 PID 952 wrote to memory of 3080 952 E61A.tmp 105 PID 952 wrote to memory of 3080 952 E61A.tmp 105 PID 952 wrote to memory of 3080 952 E61A.tmp 105 PID 3080 wrote to memory of 4712 3080 E6B6.tmp 106 PID 3080 wrote to memory of 4712 3080 E6B6.tmp 106 PID 3080 wrote to memory of 4712 3080 E6B6.tmp 106 PID 4712 wrote to memory of 3720 4712 E733.tmp 107 PID 4712 wrote to memory of 3720 4712 E733.tmp 107 PID 4712 wrote to memory of 3720 4712 E733.tmp 107 PID 3720 wrote to memory of 3372 3720 E7C0.tmp 108 PID 3720 wrote to memory of 3372 3720 E7C0.tmp 108 PID 3720 wrote to memory of 3372 3720 E7C0.tmp 108 PID 3372 wrote to memory of 3952 3372 E85C.tmp 109 PID 3372 wrote to memory of 3952 3372 E85C.tmp 109 PID 3372 wrote to memory of 3952 3372 E85C.tmp 109 PID 3952 wrote to memory of 4476 3952 E908.tmp 110 PID 3952 wrote to memory of 4476 3952 E908.tmp 110 PID 3952 wrote to memory of 4476 3952 E908.tmp 110 PID 4476 wrote to memory of 1956 4476 E9C4.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_81f12befd2efc48d98856eecb1deb10f_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"C:\Users\Admin\AppData\Local\Temp\DDFC.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"C:\Users\Admin\AppData\Local\Temp\DEB7.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4980 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"C:\Users\Admin\AppData\Local\Temp\E0FA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\E196.tmp"C:\Users\Admin\AppData\Local\Temp\E196.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\E213.tmp"C:\Users\Admin\AppData\Local\Temp\E213.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\E290.tmp"C:\Users\Admin\AppData\Local\Temp\E290.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\E32C.tmp"C:\Users\Admin\AppData\Local\Temp\E32C.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"C:\Users\Admin\AppData\Local\Temp\E3B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Users\Admin\AppData\Local\Temp\E55F.tmp"C:\Users\Admin\AppData\Local\Temp\E55F.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:952 -
C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"C:\Users\Admin\AppData\Local\Temp\E6B6.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3720 -
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\E908.tmp"C:\Users\Admin\AppData\Local\Temp\E908.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"C:\Users\Admin\AppData\Local\Temp\E9C4.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\EA41.tmp"C:\Users\Admin\AppData\Local\Temp\EA41.tmp"23⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"24⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"C:\Users\Admin\AppData\Local\Temp\EBA8.tmp"25⤵
- Executes dropped EXE
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\EC25.tmp"C:\Users\Admin\AppData\Local\Temp\EC25.tmp"26⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"C:\Users\Admin\AppData\Local\Temp\ECC1.tmp"27⤵
- Executes dropped EXE
PID:3256 -
C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"C:\Users\Admin\AppData\Local\Temp\ED9C.tmp"28⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"C:\Users\Admin\AppData\Local\Temp\EEA6.tmp"29⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"30⤵
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"C:\Users\Admin\AppData\Local\Temp\EFDE.tmp"31⤵
- Executes dropped EXE
PID:840 -
C:\Users\Admin\AppData\Local\Temp\F06B.tmp"C:\Users\Admin\AppData\Local\Temp\F06B.tmp"32⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"C:\Users\Admin\AppData\Local\Temp\F0F7.tmp"33⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\F174.tmp"C:\Users\Admin\AppData\Local\Temp\F174.tmp"34⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\F201.tmp"C:\Users\Admin\AppData\Local\Temp\F201.tmp"35⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\F28E.tmp"C:\Users\Admin\AppData\Local\Temp\F28E.tmp"36⤵
- Executes dropped EXE
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"C:\Users\Admin\AppData\Local\Temp\F2EB.tmp"37⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"38⤵
- Executes dropped EXE
PID:1020 -
C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"C:\Users\Admin\AppData\Local\Temp\F3B6.tmp"39⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"C:\Users\Admin\AppData\Local\Temp\F4D0.tmp"40⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\F52D.tmp"C:\Users\Admin\AppData\Local\Temp\F52D.tmp"41⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\F59B.tmp"C:\Users\Admin\AppData\Local\Temp\F59B.tmp"42⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\F618.tmp"C:\Users\Admin\AppData\Local\Temp\F618.tmp"43⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"44⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"C:\Users\Admin\AppData\Local\Temp\F6E3.tmp"45⤵
- Executes dropped EXE
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"46⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"C:\Users\Admin\AppData\Local\Temp\F7AE.tmp"47⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\F81B.tmp"C:\Users\Admin\AppData\Local\Temp\F81B.tmp"48⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\F889.tmp"C:\Users\Admin\AppData\Local\Temp\F889.tmp"49⤵
- Executes dropped EXE
PID:664 -
C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"C:\Users\Admin\AppData\Local\Temp\F8F6.tmp"50⤵
- Executes dropped EXE
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\F992.tmp"C:\Users\Admin\AppData\Local\Temp\F992.tmp"51⤵
- Executes dropped EXE
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"C:\Users\Admin\AppData\Local\Temp\FA0F.tmp"52⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"C:\Users\Admin\AppData\Local\Temp\FAEA.tmp"53⤵
- Executes dropped EXE
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\FB96.tmp"C:\Users\Admin\AppData\Local\Temp\FB96.tmp"54⤵
- Executes dropped EXE
PID:4232 -
C:\Users\Admin\AppData\Local\Temp\FC32.tmp"C:\Users\Admin\AppData\Local\Temp\FC32.tmp"55⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"C:\Users\Admin\AppData\Local\Temp\FCFD.tmp"56⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"C:\Users\Admin\AppData\Local\Temp\FDB9.tmp"57⤵
- Executes dropped EXE
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\FE55.tmp"C:\Users\Admin\AppData\Local\Temp\FE55.tmp"58⤵
- Executes dropped EXE
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\FF20.tmp"C:\Users\Admin\AppData\Local\Temp\FF20.tmp"59⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"C:\Users\Admin\AppData\Local\Temp\FFDC.tmp"60⤵
- Executes dropped EXE
PID:3672 -
C:\Users\Admin\AppData\Local\Temp\78.tmp"C:\Users\Admin\AppData\Local\Temp\78.tmp"61⤵
- Executes dropped EXE
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\134.tmp"C:\Users\Admin\AppData\Local\Temp\134.tmp"62⤵
- Executes dropped EXE
PID:4584 -
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"63⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\28B.tmp"C:\Users\Admin\AppData\Local\Temp\28B.tmp"64⤵
- Executes dropped EXE
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\366.tmp"C:\Users\Admin\AppData\Local\Temp\366.tmp"65⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"66⤵PID:4712
-
C:\Users\Admin\AppData\Local\Temp\47F.tmp"C:\Users\Admin\AppData\Local\Temp\47F.tmp"67⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\53B.tmp"C:\Users\Admin\AppData\Local\Temp\53B.tmp"68⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\5C7.tmp"C:\Users\Admin\AppData\Local\Temp\5C7.tmp"69⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\654.tmp"C:\Users\Admin\AppData\Local\Temp\654.tmp"70⤵PID:224
-
C:\Users\Admin\AppData\Local\Temp\700.tmp"C:\Users\Admin\AppData\Local\Temp\700.tmp"71⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\7AC.tmp"C:\Users\Admin\AppData\Local\Temp\7AC.tmp"72⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\829.tmp"C:\Users\Admin\AppData\Local\Temp\829.tmp"73⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"74⤵PID:1576
-
C:\Users\Admin\AppData\Local\Temp\923.tmp"C:\Users\Admin\AppData\Local\Temp\923.tmp"75⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"76⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\A5B.tmp"C:\Users\Admin\AppData\Local\Temp\A5B.tmp"77⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\AD8.tmp"C:\Users\Admin\AppData\Local\Temp\AD8.tmp"78⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\B65.tmp"C:\Users\Admin\AppData\Local\Temp\B65.tmp"79⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\BF2.tmp"C:\Users\Admin\AppData\Local\Temp\BF2.tmp"80⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\CEC.tmp"C:\Users\Admin\AppData\Local\Temp\CEC.tmp"81⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"82⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"83⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\E82.tmp"C:\Users\Admin\AppData\Local\Temp\E82.tmp"84⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"85⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\F7C.tmp"C:\Users\Admin\AppData\Local\Temp\F7C.tmp"86⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\1008.tmp"C:\Users\Admin\AppData\Local\Temp\1008.tmp"87⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\1095.tmp"C:\Users\Admin\AppData\Local\Temp\1095.tmp"88⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"89⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\121C.tmp"C:\Users\Admin\AppData\Local\Temp\121C.tmp"90⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\12A8.tmp"C:\Users\Admin\AppData\Local\Temp\12A8.tmp"91⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\1345.tmp"C:\Users\Admin\AppData\Local\Temp\1345.tmp"92⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\13D1.tmp"C:\Users\Admin\AppData\Local\Temp\13D1.tmp"93⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"94⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"95⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"96⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\1604.tmp"C:\Users\Admin\AppData\Local\Temp\1604.tmp"97⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\16A0.tmp"C:\Users\Admin\AppData\Local\Temp\16A0.tmp"98⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"99⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\17AA.tmp"C:\Users\Admin\AppData\Local\Temp\17AA.tmp"100⤵PID:4232
-
C:\Users\Admin\AppData\Local\Temp\1836.tmp"C:\Users\Admin\AppData\Local\Temp\1836.tmp"101⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\1930.tmp"C:\Users\Admin\AppData\Local\Temp\1930.tmp"102⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\19DC.tmp"C:\Users\Admin\AppData\Local\Temp\19DC.tmp"103⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\1A59.tmp"C:\Users\Admin\AppData\Local\Temp\1A59.tmp"104⤵PID:4532
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"105⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\1B63.tmp"C:\Users\Admin\AppData\Local\Temp\1B63.tmp"106⤵PID:492
-
C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"C:\Users\Admin\AppData\Local\Temp\1C1E.tmp"107⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"108⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\1D37.tmp"C:\Users\Admin\AppData\Local\Temp\1D37.tmp"109⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"C:\Users\Admin\AppData\Local\Temp\1DD4.tmp"110⤵PID:3972
-
C:\Users\Admin\AppData\Local\Temp\1E80.tmp"C:\Users\Admin\AppData\Local\Temp\1E80.tmp"111⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"C:\Users\Admin\AppData\Local\Temp\1F0C.tmp"112⤵PID:1404
-
C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"C:\Users\Admin\AppData\Local\Temp\1F7A.tmp"113⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"114⤵PID:4184
-
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"115⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"116⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\21BC.tmp"C:\Users\Admin\AppData\Local\Temp\21BC.tmp"117⤵PID:4380
-
C:\Users\Admin\AppData\Local\Temp\2258.tmp"C:\Users\Admin\AppData\Local\Temp\2258.tmp"118⤵PID:4572
-
C:\Users\Admin\AppData\Local\Temp\22C5.tmp"C:\Users\Admin\AppData\Local\Temp\22C5.tmp"119⤵PID:4876
-
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"120⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\23BF.tmp"C:\Users\Admin\AppData\Local\Temp\23BF.tmp"121⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\244C.tmp"C:\Users\Admin\AppData\Local\Temp\244C.tmp"122⤵PID:2232
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-