Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
09/07/2024, 12:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe
Resource
win7-20240704-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe
Resource
win10v2004-20240704-en
2 signatures
150 seconds
General
-
Target
2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe
-
Size
520KB
-
MD5
d8ce469012f70f30dc83776b97e42b4d
-
SHA1
1c0f6ac521eee394e480d5ef3e24a73ab2c30beb
-
SHA256
ffff11d922c544827de034ec97c5c457ec2a1134aec52fef3cd03a57896c29ce
-
SHA512
60c22a5193ef28274a7544be94ede126372d3a666e243934c3cbe6b398c8441bee561c2f4c90e790e6c5f19e7ea5a33af7aa0b3bac24f84385463cc7f14f7b84
-
SSDEEP
12288:gj8fuxR21t5i8fpU0R+CeD8KkO7JDgZiH1SwBfN3NZ:gj8fuK1GYpt+CeD8q7p6o1Sc9N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1820 A652.tmp 2372 A6DF.tmp 3596 A76B.tmp 1268 A7D9.tmp 1996 A836.tmp 1920 A8C3.tmp 1276 A940.tmp 1012 A9AD.tmp 1384 AA2A.tmp 4372 AA98.tmp 5104 AB05.tmp 2348 AB63.tmp 3012 ABE0.tmp 3528 AC2E.tmp 5076 AC9B.tmp 1816 ACF9.tmp 2536 AD47.tmp 532 ADC4.tmp 1784 AE22.tmp 3980 AE8F.tmp 3732 AEED.tmp 4684 AF4B.tmp 3272 AFC8.tmp 3064 B016.tmp 1728 B0A3.tmp 4716 B110.tmp 4444 B18D.tmp 4060 B1EB.tmp 1028 B268.tmp 4104 B2C5.tmp 1424 B314.tmp 1832 B362.tmp 1976 B3BF.tmp 3128 B40E.tmp 1812 B45C.tmp 1004 B4AA.tmp 4880 B508.tmp 3888 B556.tmp 3240 B5A4.tmp 3312 B5F2.tmp 5008 B650.tmp 4760 B69E.tmp 4792 B6FC.tmp 2196 B759.tmp 3320 B7A7.tmp 1504 B805.tmp 2872 B853.tmp 2072 B8A1.tmp 3536 B8FF.tmp 3408 B95D.tmp 4380 B9AB.tmp 4364 BA09.tmp 3904 BA57.tmp 3024 BAA5.tmp 976 BAF3.tmp 4956 BB41.tmp 3060 BB9F.tmp 3428 BBED.tmp 4172 BC4B.tmp 544 BC99.tmp 4180 BCF7.tmp 1268 BD55.tmp 3348 BDA3.tmp 4712 BDF1.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 1820 3040 2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe 83 PID 3040 wrote to memory of 1820 3040 2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe 83 PID 3040 wrote to memory of 1820 3040 2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe 83 PID 1820 wrote to memory of 2372 1820 A652.tmp 85 PID 1820 wrote to memory of 2372 1820 A652.tmp 85 PID 1820 wrote to memory of 2372 1820 A652.tmp 85 PID 2372 wrote to memory of 3596 2372 A6DF.tmp 87 PID 2372 wrote to memory of 3596 2372 A6DF.tmp 87 PID 2372 wrote to memory of 3596 2372 A6DF.tmp 87 PID 3596 wrote to memory of 1268 3596 A76B.tmp 88 PID 3596 wrote to memory of 1268 3596 A76B.tmp 88 PID 3596 wrote to memory of 1268 3596 A76B.tmp 88 PID 1268 wrote to memory of 1996 1268 A7D9.tmp 89 PID 1268 wrote to memory of 1996 1268 A7D9.tmp 89 PID 1268 wrote to memory of 1996 1268 A7D9.tmp 89 PID 1996 wrote to memory of 1920 1996 A836.tmp 90 PID 1996 wrote to memory of 1920 1996 A836.tmp 90 PID 1996 wrote to memory of 1920 1996 A836.tmp 90 PID 1920 wrote to memory of 1276 1920 A8C3.tmp 91 PID 1920 wrote to memory of 1276 1920 A8C3.tmp 91 PID 1920 wrote to memory of 1276 1920 A8C3.tmp 91 PID 1276 wrote to memory of 1012 1276 A940.tmp 92 PID 1276 wrote to memory of 1012 1276 A940.tmp 92 PID 1276 wrote to memory of 1012 1276 A940.tmp 92 PID 1012 wrote to memory of 1384 1012 A9AD.tmp 93 PID 1012 wrote to memory of 1384 1012 A9AD.tmp 93 PID 1012 wrote to memory of 1384 1012 A9AD.tmp 93 PID 1384 wrote to memory of 4372 1384 AA2A.tmp 94 PID 1384 wrote to memory of 4372 1384 AA2A.tmp 94 PID 1384 wrote to memory of 4372 1384 AA2A.tmp 94 PID 4372 wrote to memory of 5104 4372 AA98.tmp 95 PID 4372 wrote to memory of 5104 4372 AA98.tmp 95 PID 4372 wrote to memory of 5104 4372 AA98.tmp 95 PID 5104 wrote to memory of 2348 5104 AB05.tmp 96 PID 5104 wrote to memory of 2348 5104 AB05.tmp 96 PID 5104 wrote to memory of 2348 5104 AB05.tmp 96 PID 2348 wrote to memory of 3012 2348 AB63.tmp 97 PID 2348 wrote to memory of 3012 2348 AB63.tmp 97 PID 2348 wrote to memory of 3012 2348 AB63.tmp 97 PID 3012 wrote to memory of 3528 3012 ABE0.tmp 98 PID 3012 wrote to memory of 3528 3012 ABE0.tmp 98 PID 3012 wrote to memory of 3528 3012 ABE0.tmp 98 PID 3528 wrote to memory of 5076 3528 AC2E.tmp 99 PID 3528 wrote to memory of 5076 3528 AC2E.tmp 99 PID 3528 wrote to memory of 5076 3528 AC2E.tmp 99 PID 5076 wrote to memory of 1816 5076 AC9B.tmp 100 PID 5076 wrote to memory of 1816 5076 AC9B.tmp 100 PID 5076 wrote to memory of 1816 5076 AC9B.tmp 100 PID 1816 wrote to memory of 2536 1816 ACF9.tmp 101 PID 1816 wrote to memory of 2536 1816 ACF9.tmp 101 PID 1816 wrote to memory of 2536 1816 ACF9.tmp 101 PID 2536 wrote to memory of 532 2536 AD47.tmp 102 PID 2536 wrote to memory of 532 2536 AD47.tmp 102 PID 2536 wrote to memory of 532 2536 AD47.tmp 102 PID 532 wrote to memory of 1784 532 ADC4.tmp 103 PID 532 wrote to memory of 1784 532 ADC4.tmp 103 PID 532 wrote to memory of 1784 532 ADC4.tmp 103 PID 1784 wrote to memory of 3980 1784 AE22.tmp 104 PID 1784 wrote to memory of 3980 1784 AE22.tmp 104 PID 1784 wrote to memory of 3980 1784 AE22.tmp 104 PID 3980 wrote to memory of 3732 3980 AE8F.tmp 105 PID 3980 wrote to memory of 3732 3980 AE8F.tmp 105 PID 3980 wrote to memory of 3732 3980 AE8F.tmp 105 PID 3732 wrote to memory of 4684 3732 AEED.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-09_d8ce469012f70f30dc83776b97e42b4d_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"C:\Users\Admin\AppData\Local\Temp\A8C3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\A940.tmp"C:\Users\Admin\AppData\Local\Temp\A940.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\AA98.tmp"C:\Users\Admin\AppData\Local\Temp\AA98.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\AB05.tmp"C:\Users\Admin\AppData\Local\Temp\AB05.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\AB63.tmp"C:\Users\Admin\AppData\Local\Temp\AB63.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3528 -
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"C:\Users\Admin\AppData\Local\Temp\ADC4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"C:\Users\Admin\AppData\Local\Temp\AF4B.tmp"23⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"24⤵
- Executes dropped EXE
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"25⤵
- Executes dropped EXE
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"26⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"27⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\B18D.tmp"C:\Users\Admin\AppData\Local\Temp\B18D.tmp"28⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"29⤵
- Executes dropped EXE
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"30⤵
- Executes dropped EXE
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"C:\Users\Admin\AppData\Local\Temp\B2C5.tmp"31⤵
- Executes dropped EXE
PID:4104 -
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"32⤵
- Executes dropped EXE
PID:1424 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"33⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"34⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B40E.tmp"C:\Users\Admin\AppData\Local\Temp\B40E.tmp"35⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\B45C.tmp"C:\Users\Admin\AppData\Local\Temp\B45C.tmp"36⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"C:\Users\Admin\AppData\Local\Temp\B4AA.tmp"37⤵
- Executes dropped EXE
PID:1004 -
C:\Users\Admin\AppData\Local\Temp\B508.tmp"C:\Users\Admin\AppData\Local\Temp\B508.tmp"38⤵
- Executes dropped EXE
PID:4880 -
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"39⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"C:\Users\Admin\AppData\Local\Temp\B5A4.tmp"40⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"C:\Users\Admin\AppData\Local\Temp\B5F2.tmp"41⤵
- Executes dropped EXE
PID:3312 -
C:\Users\Admin\AppData\Local\Temp\B650.tmp"C:\Users\Admin\AppData\Local\Temp\B650.tmp"42⤵
- Executes dropped EXE
PID:5008 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"43⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"44⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"45⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"C:\Users\Admin\AppData\Local\Temp\B7A7.tmp"46⤵
- Executes dropped EXE
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\B805.tmp"C:\Users\Admin\AppData\Local\Temp\B805.tmp"47⤵
- Executes dropped EXE
PID:1504 -
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"48⤵
- Executes dropped EXE
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"C:\Users\Admin\AppData\Local\Temp\B8A1.tmp"49⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"50⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"51⤵
- Executes dropped EXE
PID:3408 -
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"52⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"53⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"54⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"C:\Users\Admin\AppData\Local\Temp\BAA5.tmp"55⤵
- Executes dropped EXE
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"56⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"57⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"58⤵
- Executes dropped EXE
PID:3060 -
C:\Users\Admin\AppData\Local\Temp\BBED.tmp"C:\Users\Admin\AppData\Local\Temp\BBED.tmp"59⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"C:\Users\Admin\AppData\Local\Temp\BC4B.tmp"60⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"61⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"C:\Users\Admin\AppData\Local\Temp\BCF7.tmp"62⤵
- Executes dropped EXE
PID:4180 -
C:\Users\Admin\AppData\Local\Temp\BD55.tmp"C:\Users\Admin\AppData\Local\Temp\BD55.tmp"63⤵
- Executes dropped EXE
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"64⤵
- Executes dropped EXE
PID:3348 -
C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"C:\Users\Admin\AppData\Local\Temp\BDF1.tmp"65⤵
- Executes dropped EXE
PID:4712 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"66⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"67⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"C:\Users\Admin\AppData\Local\Temp\BEFA.tmp"68⤵PID:2312
-
C:\Users\Admin\AppData\Local\Temp\BF58.tmp"C:\Users\Admin\AppData\Local\Temp\BF58.tmp"69⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"70⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"71⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\C043.tmp"C:\Users\Admin\AppData\Local\Temp\C043.tmp"72⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"73⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"74⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"75⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"76⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"77⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"78⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"79⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"80⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\C331.tmp"C:\Users\Admin\AppData\Local\Temp\C331.tmp"81⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"82⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"C:\Users\Admin\AppData\Local\Temp\C3EC.tmp"83⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\C43A.tmp"C:\Users\Admin\AppData\Local\Temp\C43A.tmp"84⤵PID:1260
-
C:\Users\Admin\AppData\Local\Temp\C488.tmp"C:\Users\Admin\AppData\Local\Temp\C488.tmp"85⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"86⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\C544.tmp"C:\Users\Admin\AppData\Local\Temp\C544.tmp"87⤵PID:3732
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"88⤵PID:4684
-
C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"C:\Users\Admin\AppData\Local\Temp\C5FF.tmp"89⤵PID:4948
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"90⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"91⤵PID:1396
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"92⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\C767.tmp"C:\Users\Admin\AppData\Local\Temp\C767.tmp"93⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"C:\Users\Admin\AppData\Local\Temp\C7C4.tmp"94⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"95⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\C861.tmp"C:\Users\Admin\AppData\Local\Temp\C861.tmp"96⤵PID:4012
-
C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"C:\Users\Admin\AppData\Local\Temp\C8BE.tmp"97⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"98⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\C96A.tmp"C:\Users\Admin\AppData\Local\Temp\C96A.tmp"99⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"C:\Users\Admin\AppData\Local\Temp\C9C8.tmp"100⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"101⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"C:\Users\Admin\AppData\Local\Temp\CAE1.tmp"103⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"104⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"105⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"C:\Users\Admin\AppData\Local\Temp\CBDB.tmp"106⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\CC29.tmp"C:\Users\Admin\AppData\Local\Temp\CC29.tmp"107⤵PID:3692
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"108⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"C:\Users\Admin\AppData\Local\Temp\CCE5.tmp"109⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\CD33.tmp"C:\Users\Admin\AppData\Local\Temp\CD33.tmp"110⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"111⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"112⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"C:\Users\Admin\AppData\Local\Temp\CE1D.tmp"113⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"C:\Users\Admin\AppData\Local\Temp\CE6C.tmp"114⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"115⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"116⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"117⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"118⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\D002.tmp"C:\Users\Admin\AppData\Local\Temp\D002.tmp"119⤵PID:4932
-
C:\Users\Admin\AppData\Local\Temp\D060.tmp"C:\Users\Admin\AppData\Local\Temp\D060.tmp"120⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"C:\Users\Admin\AppData\Local\Temp\D0AE.tmp"121⤵PID:1388
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"122⤵PID:2496
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-