Analysis
-
max time kernel
150s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
10-07-2024 08:01
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
Resource
win7-20240708-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe
-
Size
488KB
-
MD5
caef0543ee65cfe04f95e811349642ef
-
SHA1
c0eed32e2366c47f5a12285e27d47fc4f42bccc4
-
SHA256
c8b0ec57205dd82381be9612ad44cea4848f4b0de08dd443171332823bed8083
-
SHA512
f09075932831341d3f5ca3397512a48015c1c0356ed528f7faa950a4c3eaed5296b906c2f7ff246f26c40af0cfa5bd1ed1c57cbd4fe83473fb3412dd03abe34e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7gWPwNuy0uuehDWzUtv5T0MeCCzKudM6BXRPG:/U5rCOTeiDGAluTSKd0bRKyrVBEtNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3684 A076.tmp 3920 A103.tmp 1524 A1BE.tmp 2612 A2A8.tmp 1588 A325.tmp 1048 A3D1.tmp 4768 A48D.tmp 4016 A548.tmp 2856 A5B6.tmp 4992 A633.tmp 1180 A6A0.tmp 2464 A70D.tmp 1316 A7AA.tmp 4960 A817.tmp 2948 A8A4.tmp 3996 A921.tmp 5024 A9CD.tmp 4120 AA4A.tmp 2072 AAD6.tmp 4268 AB53.tmp 1940 ABC1.tmp 2520 AC5D.tmp 5104 AD28.tmp 1676 ADE3.tmp 1172 AE80.tmp 1320 AF1C.tmp 1168 AFA9.tmp 1976 B006.tmp 3444 B0A3.tmp 4972 B120.tmp 1152 B1BC.tmp 3732 B248.tmp 1740 B2A6.tmp 2684 B304.tmp 2364 B362.tmp 2620 B3BF.tmp 1876 B41D.tmp 2596 B48B.tmp 1436 B4F8.tmp 384 B565.tmp 1256 B5D3.tmp 2184 B630.tmp 4024 B68E.tmp 2068 B6EC.tmp 2196 B74A.tmp 4332 B7B7.tmp 4512 B824.tmp 1324 B892.tmp 4140 B8FF.tmp 1848 B96D.tmp 4256 B9DA.tmp 3776 BA47.tmp 208 BAB5.tmp 812 BB12.tmp 1748 BB70.tmp 1428 BBDE.tmp 1920 BCA9.tmp 4864 BD06.tmp 3112 BD74.tmp 4904 BDE1.tmp 968 BE4F.tmp 4560 BEAC.tmp 3920 BF1A.tmp 3196 BF87.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 112 wrote to memory of 3684 112 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 83 PID 112 wrote to memory of 3684 112 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 83 PID 112 wrote to memory of 3684 112 2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe 83 PID 3684 wrote to memory of 3920 3684 A076.tmp 84 PID 3684 wrote to memory of 3920 3684 A076.tmp 84 PID 3684 wrote to memory of 3920 3684 A076.tmp 84 PID 3920 wrote to memory of 1524 3920 A103.tmp 86 PID 3920 wrote to memory of 1524 3920 A103.tmp 86 PID 3920 wrote to memory of 1524 3920 A103.tmp 86 PID 1524 wrote to memory of 2612 1524 A1BE.tmp 87 PID 1524 wrote to memory of 2612 1524 A1BE.tmp 87 PID 1524 wrote to memory of 2612 1524 A1BE.tmp 87 PID 2612 wrote to memory of 1588 2612 A2A8.tmp 88 PID 2612 wrote to memory of 1588 2612 A2A8.tmp 88 PID 2612 wrote to memory of 1588 2612 A2A8.tmp 88 PID 1588 wrote to memory of 1048 1588 A325.tmp 89 PID 1588 wrote to memory of 1048 1588 A325.tmp 89 PID 1588 wrote to memory of 1048 1588 A325.tmp 89 PID 1048 wrote to memory of 4768 1048 A3D1.tmp 90 PID 1048 wrote to memory of 4768 1048 A3D1.tmp 90 PID 1048 wrote to memory of 4768 1048 A3D1.tmp 90 PID 4768 wrote to memory of 4016 4768 A48D.tmp 91 PID 4768 wrote to memory of 4016 4768 A48D.tmp 91 PID 4768 wrote to memory of 4016 4768 A48D.tmp 91 PID 4016 wrote to memory of 2856 4016 A548.tmp 92 PID 4016 wrote to memory of 2856 4016 A548.tmp 92 PID 4016 wrote to memory of 2856 4016 A548.tmp 92 PID 2856 wrote to memory of 4992 2856 A5B6.tmp 93 PID 2856 wrote to memory of 4992 2856 A5B6.tmp 93 PID 2856 wrote to memory of 4992 2856 A5B6.tmp 93 PID 4992 wrote to memory of 1180 4992 A633.tmp 94 PID 4992 wrote to memory of 1180 4992 A633.tmp 94 PID 4992 wrote to memory of 1180 4992 A633.tmp 94 PID 1180 wrote to memory of 2464 1180 A6A0.tmp 95 PID 1180 wrote to memory of 2464 1180 A6A0.tmp 95 PID 1180 wrote to memory of 2464 1180 A6A0.tmp 95 PID 2464 wrote to memory of 1316 2464 A70D.tmp 96 PID 2464 wrote to memory of 1316 2464 A70D.tmp 96 PID 2464 wrote to memory of 1316 2464 A70D.tmp 96 PID 1316 wrote to memory of 4960 1316 A7AA.tmp 97 PID 1316 wrote to memory of 4960 1316 A7AA.tmp 97 PID 1316 wrote to memory of 4960 1316 A7AA.tmp 97 PID 4960 wrote to memory of 2948 4960 A817.tmp 98 PID 4960 wrote to memory of 2948 4960 A817.tmp 98 PID 4960 wrote to memory of 2948 4960 A817.tmp 98 PID 2948 wrote to memory of 3996 2948 A8A4.tmp 99 PID 2948 wrote to memory of 3996 2948 A8A4.tmp 99 PID 2948 wrote to memory of 3996 2948 A8A4.tmp 99 PID 3996 wrote to memory of 5024 3996 A921.tmp 100 PID 3996 wrote to memory of 5024 3996 A921.tmp 100 PID 3996 wrote to memory of 5024 3996 A921.tmp 100 PID 5024 wrote to memory of 4120 5024 A9CD.tmp 101 PID 5024 wrote to memory of 4120 5024 A9CD.tmp 101 PID 5024 wrote to memory of 4120 5024 A9CD.tmp 101 PID 4120 wrote to memory of 2072 4120 AA4A.tmp 102 PID 4120 wrote to memory of 2072 4120 AA4A.tmp 102 PID 4120 wrote to memory of 2072 4120 AA4A.tmp 102 PID 2072 wrote to memory of 4268 2072 AAD6.tmp 103 PID 2072 wrote to memory of 4268 2072 AAD6.tmp 103 PID 2072 wrote to memory of 4268 2072 AAD6.tmp 103 PID 4268 wrote to memory of 1940 4268 AB53.tmp 104 PID 4268 wrote to memory of 1940 4268 AB53.tmp 104 PID 4268 wrote to memory of 1940 4268 AB53.tmp 104 PID 1940 wrote to memory of 2520 1940 ABC1.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-07-10_caef0543ee65cfe04f95e811349642ef_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684 -
C:\Users\Admin\AppData\Local\Temp\A103.tmp"C:\Users\Admin\AppData\Local\Temp\A103.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\A325.tmp"C:\Users\Admin\AppData\Local\Temp\A325.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\A633.tmp"C:\Users\Admin\AppData\Local\Temp\A633.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"C:\Users\Admin\AppData\Local\Temp\A6A0.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\A817.tmp"C:\Users\Admin\AppData\Local\Temp\A817.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3996 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"C:\Users\Admin\AppData\Local\Temp\AAD6.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"C:\Users\Admin\AppData\Local\Temp\ABC1.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"23⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\AD28.tmp"C:\Users\Admin\AppData\Local\Temp\AD28.tmp"24⤵
- Executes dropped EXE
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"C:\Users\Admin\AppData\Local\Temp\ADE3.tmp"25⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"26⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"C:\Users\Admin\AppData\Local\Temp\AF1C.tmp"27⤵
- Executes dropped EXE
PID:1320 -
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"28⤵
- Executes dropped EXE
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"29⤵
- Executes dropped EXE
PID:1976 -
C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"C:\Users\Admin\AppData\Local\Temp\B0A3.tmp"30⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\B120.tmp"C:\Users\Admin\AppData\Local\Temp\B120.tmp"31⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"C:\Users\Admin\AppData\Local\Temp\B1BC.tmp"32⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\B248.tmp"C:\Users\Admin\AppData\Local\Temp\B248.tmp"33⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"34⤵
- Executes dropped EXE
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"35⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"36⤵
- Executes dropped EXE
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"37⤵
- Executes dropped EXE
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\B41D.tmp"C:\Users\Admin\AppData\Local\Temp\B41D.tmp"38⤵
- Executes dropped EXE
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\B48B.tmp"C:\Users\Admin\AppData\Local\Temp\B48B.tmp"39⤵
- Executes dropped EXE
PID:2596 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"40⤵
- Executes dropped EXE
PID:1436 -
C:\Users\Admin\AppData\Local\Temp\B565.tmp"C:\Users\Admin\AppData\Local\Temp\B565.tmp"41⤵
- Executes dropped EXE
PID:384 -
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"42⤵
- Executes dropped EXE
PID:1256 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"43⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\B68E.tmp"C:\Users\Admin\AppData\Local\Temp\B68E.tmp"44⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"45⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\B74A.tmp"C:\Users\Admin\AppData\Local\Temp\B74A.tmp"46⤵
- Executes dropped EXE
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"47⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\B824.tmp"C:\Users\Admin\AppData\Local\Temp\B824.tmp"48⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\B892.tmp"C:\Users\Admin\AppData\Local\Temp\B892.tmp"49⤵
- Executes dropped EXE
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"C:\Users\Admin\AppData\Local\Temp\B8FF.tmp"50⤵
- Executes dropped EXE
PID:4140 -
C:\Users\Admin\AppData\Local\Temp\B96D.tmp"C:\Users\Admin\AppData\Local\Temp\B96D.tmp"51⤵
- Executes dropped EXE
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"52⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"53⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"54⤵
- Executes dropped EXE
PID:208 -
C:\Users\Admin\AppData\Local\Temp\BB12.tmp"C:\Users\Admin\AppData\Local\Temp\BB12.tmp"55⤵
- Executes dropped EXE
PID:812 -
C:\Users\Admin\AppData\Local\Temp\BB70.tmp"C:\Users\Admin\AppData\Local\Temp\BB70.tmp"56⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"C:\Users\Admin\AppData\Local\Temp\BBDE.tmp"57⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"58⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"59⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"60⤵
- Executes dropped EXE
PID:4864 -
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"61⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"62⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"63⤵
- Executes dropped EXE
PID:968 -
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"64⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"C:\Users\Admin\AppData\Local\Temp\BF1A.tmp"65⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\BF87.tmp"C:\Users\Admin\AppData\Local\Temp\BF87.tmp"66⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"C:\Users\Admin\AppData\Local\Temp\BFF4.tmp"67⤵PID:1176
-
C:\Users\Admin\AppData\Local\Temp\C062.tmp"C:\Users\Admin\AppData\Local\Temp\C062.tmp"68⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"69⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"70⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"71⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"C:\Users\Admin\AppData\Local\Temp\C1F8.tmp"72⤵PID:2752
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"73⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"C:\Users\Admin\AppData\Local\Temp\C2E2.tmp"74⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\C340.tmp"C:\Users\Admin\AppData\Local\Temp\C340.tmp"75⤵PID:2340
-
C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"C:\Users\Admin\AppData\Local\Temp\C3AE.tmp"76⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"77⤵PID:4992
-
C:\Users\Admin\AppData\Local\Temp\C479.tmp"C:\Users\Admin\AppData\Local\Temp\C479.tmp"78⤵PID:3728
-
C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"C:\Users\Admin\AppData\Local\Temp\C4E6.tmp"79⤵PID:3796
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"80⤵PID:1412
-
C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"C:\Users\Admin\AppData\Local\Temp\C5D0.tmp"81⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"82⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"C:\Users\Admin\AppData\Local\Temp\C6BB.tmp"83⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"84⤵PID:732
-
C:\Users\Admin\AppData\Local\Temp\C786.tmp"C:\Users\Admin\AppData\Local\Temp\C786.tmp"85⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"C:\Users\Admin\AppData\Local\Temp\C7F3.tmp"86⤵PID:5004
-
C:\Users\Admin\AppData\Local\Temp\C851.tmp"C:\Users\Admin\AppData\Local\Temp\C851.tmp"87⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"C:\Users\Admin\AppData\Local\Temp\C8AF.tmp"88⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\C90D.tmp"C:\Users\Admin\AppData\Local\Temp\C90D.tmp"89⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"90⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"91⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\CA55.tmp"C:\Users\Admin\AppData\Local\Temp\CA55.tmp"92⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"93⤵PID:3656
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"94⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"C:\Users\Admin\AppData\Local\Temp\CB7E.tmp"95⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"C:\Users\Admin\AppData\Local\Temp\CBEB.tmp"96⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\CC58.tmp"C:\Users\Admin\AppData\Local\Temp\CC58.tmp"97⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"C:\Users\Admin\AppData\Local\Temp\CCB6.tmp"98⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"99⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\CD91.tmp"C:\Users\Admin\AppData\Local\Temp\CD91.tmp"100⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"C:\Users\Admin\AppData\Local\Temp\CE0E.tmp"101⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"C:\Users\Admin\AppData\Local\Temp\CE5C.tmp"102⤵PID:2784
-
C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"C:\Users\Admin\AppData\Local\Temp\CEC9.tmp"103⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\CF27.tmp"C:\Users\Admin\AppData\Local\Temp\CF27.tmp"104⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\CF94.tmp"C:\Users\Admin\AppData\Local\Temp\CF94.tmp"105⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"C:\Users\Admin\AppData\Local\Temp\CFF2.tmp"106⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\D050.tmp"C:\Users\Admin\AppData\Local\Temp\D050.tmp"107⤵PID:3748
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"108⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"109⤵PID:720
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"110⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"111⤵PID:32
-
C:\Users\Admin\AppData\Local\Temp\D225.tmp"C:\Users\Admin\AppData\Local\Temp\D225.tmp"112⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\D282.tmp"C:\Users\Admin\AppData\Local\Temp\D282.tmp"113⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"C:\Users\Admin\AppData\Local\Temp\D2F0.tmp"114⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\D35D.tmp"C:\Users\Admin\AppData\Local\Temp\D35D.tmp"115⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"C:\Users\Admin\AppData\Local\Temp\D3AB.tmp"116⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"117⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"118⤵PID:4040
-
C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"C:\Users\Admin\AppData\Local\Temp\D4A5.tmp"119⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"120⤵PID:3816
-
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"121⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"122⤵PID:5056
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-