Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 21:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe
-
Size
520KB
-
MD5
ef0bc6d25aca144eb3098564aa293212
-
SHA1
fa310837e29900b4d01bda513cd2eaf503032d44
-
SHA256
d5d38dcb051cfac5a57ef018195a1993819896a345ef652460f9a1bfa2dac72a
-
SHA512
8016f14f6f5782f2b180eac755b6433b2a2e033d7e7508ed3905571ce822620c71cf7f604420f53838d3012763d9ab0e632e01131bc5cffa72a81149f3e38551
-
SSDEEP
12288:gj8fuxR21t5i8fl+CaEkeHebEHA9ip1ENZ:gj8fuK1GYvnkLAg9OEN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
5F08.tmp5F75.tmp5FE3.tmp6050.tmp60BD.tmp612B.tmp61B7.tmp6234.tmp6292.tmp6300.tmp635D.tmp63AB.tmp6409.tmp6457.tmp64C5.tmp6522.tmp6590.tmp65DE.tmp667A.tmp66D8.tmp6726.tmp67A3.tmp6801.tmp686E.tmp68CC.tmp6949.tmp69A7.tmp6A33.tmp6AA1.tmp6B0E.tmp6B7B.tmp6BE9.tmp6C56.tmp6CA4.tmp6D02.tmp6D50.tmp6D9E.tmp6DEC.tmp6E3B.tmp6E89.tmp6EE6.tmp6F35.tmp6F83.tmp6FE0.tmp702F.tmp707D.tmp70DA.tmp7129.tmp7186.tmp71D4.tmp7223.tmp7271.tmp72BF.tmp730D.tmp735B.tmp73A9.tmp7407.tmp7455.tmp74A3.tmp7501.tmp754F.tmp759D.tmp75FB.tmp7659.tmppid process 2328 5F08.tmp 2080 5F75.tmp 2756 5FE3.tmp 2208 6050.tmp 3660 60BD.tmp 1440 612B.tmp 4160 61B7.tmp 2584 6234.tmp 4336 6292.tmp 3008 6300.tmp 2212 635D.tmp 3152 63AB.tmp 1216 6409.tmp 1704 6457.tmp 3564 64C5.tmp 2684 6522.tmp 3728 6590.tmp 1956 65DE.tmp 528 667A.tmp 5104 66D8.tmp 4184 6726.tmp 336 67A3.tmp 400 6801.tmp 4796 686E.tmp 4964 68CC.tmp 2760 6949.tmp 3344 69A7.tmp 2880 6A33.tmp 4476 6AA1.tmp 2032 6B0E.tmp 1300 6B7B.tmp 4576 6BE9.tmp 4904 6C56.tmp 1800 6CA4.tmp 4296 6D02.tmp 4736 6D50.tmp 1116 6D9E.tmp 1520 6DEC.tmp 544 6E3B.tmp 3940 6E89.tmp 3968 6EE6.tmp 1944 6F35.tmp 1896 6F83.tmp 3888 6FE0.tmp 2324 702F.tmp 1744 707D.tmp 3260 70DA.tmp 1524 7129.tmp 3716 7186.tmp 2036 71D4.tmp 4284 7223.tmp 4952 7271.tmp 316 72BF.tmp 4244 730D.tmp 3956 735B.tmp 5028 73A9.tmp 1012 7407.tmp 4064 7455.tmp 1548 74A3.tmp 4592 7501.tmp 5036 754F.tmp 2576 759D.tmp 4976 75FB.tmp 4160 7659.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe5F08.tmp5F75.tmp5FE3.tmp6050.tmp60BD.tmp612B.tmp61B7.tmp6234.tmp6292.tmp6300.tmp635D.tmp63AB.tmp6409.tmp6457.tmp64C5.tmp6522.tmp6590.tmp65DE.tmp667A.tmp66D8.tmp6726.tmpdescription pid process target process PID 316 wrote to memory of 2328 316 2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe 5F08.tmp PID 316 wrote to memory of 2328 316 2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe 5F08.tmp PID 316 wrote to memory of 2328 316 2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe 5F08.tmp PID 2328 wrote to memory of 2080 2328 5F08.tmp 5F75.tmp PID 2328 wrote to memory of 2080 2328 5F08.tmp 5F75.tmp PID 2328 wrote to memory of 2080 2328 5F08.tmp 5F75.tmp PID 2080 wrote to memory of 2756 2080 5F75.tmp 5FE3.tmp PID 2080 wrote to memory of 2756 2080 5F75.tmp 5FE3.tmp PID 2080 wrote to memory of 2756 2080 5F75.tmp 5FE3.tmp PID 2756 wrote to memory of 2208 2756 5FE3.tmp 6050.tmp PID 2756 wrote to memory of 2208 2756 5FE3.tmp 6050.tmp PID 2756 wrote to memory of 2208 2756 5FE3.tmp 6050.tmp PID 2208 wrote to memory of 3660 2208 6050.tmp 60BD.tmp PID 2208 wrote to memory of 3660 2208 6050.tmp 60BD.tmp PID 2208 wrote to memory of 3660 2208 6050.tmp 60BD.tmp PID 3660 wrote to memory of 1440 3660 60BD.tmp 612B.tmp PID 3660 wrote to memory of 1440 3660 60BD.tmp 612B.tmp PID 3660 wrote to memory of 1440 3660 60BD.tmp 612B.tmp PID 1440 wrote to memory of 4160 1440 612B.tmp 61B7.tmp PID 1440 wrote to memory of 4160 1440 612B.tmp 61B7.tmp PID 1440 wrote to memory of 4160 1440 612B.tmp 61B7.tmp PID 4160 wrote to memory of 2584 4160 61B7.tmp 6234.tmp PID 4160 wrote to memory of 2584 4160 61B7.tmp 6234.tmp PID 4160 wrote to memory of 2584 4160 61B7.tmp 6234.tmp PID 2584 wrote to memory of 4336 2584 6234.tmp 6292.tmp PID 2584 wrote to memory of 4336 2584 6234.tmp 6292.tmp PID 2584 wrote to memory of 4336 2584 6234.tmp 6292.tmp PID 4336 wrote to memory of 3008 4336 6292.tmp 6300.tmp PID 4336 wrote to memory of 3008 4336 6292.tmp 6300.tmp PID 4336 wrote to memory of 3008 4336 6292.tmp 6300.tmp PID 3008 wrote to memory of 2212 3008 6300.tmp 635D.tmp PID 3008 wrote to memory of 2212 3008 6300.tmp 635D.tmp PID 3008 wrote to memory of 2212 3008 6300.tmp 635D.tmp PID 2212 wrote to memory of 3152 2212 635D.tmp 63AB.tmp PID 2212 wrote to memory of 3152 2212 635D.tmp 63AB.tmp PID 2212 wrote to memory of 3152 2212 635D.tmp 63AB.tmp PID 3152 wrote to memory of 1216 3152 63AB.tmp 6409.tmp PID 3152 wrote to memory of 1216 3152 63AB.tmp 6409.tmp PID 3152 wrote to memory of 1216 3152 63AB.tmp 6409.tmp PID 1216 wrote to memory of 1704 1216 6409.tmp 6457.tmp PID 1216 wrote to memory of 1704 1216 6409.tmp 6457.tmp PID 1216 wrote to memory of 1704 1216 6409.tmp 6457.tmp PID 1704 wrote to memory of 3564 1704 6457.tmp 64C5.tmp PID 1704 wrote to memory of 3564 1704 6457.tmp 64C5.tmp PID 1704 wrote to memory of 3564 1704 6457.tmp 64C5.tmp PID 3564 wrote to memory of 2684 3564 64C5.tmp 6522.tmp PID 3564 wrote to memory of 2684 3564 64C5.tmp 6522.tmp PID 3564 wrote to memory of 2684 3564 64C5.tmp 6522.tmp PID 2684 wrote to memory of 3728 2684 6522.tmp 6590.tmp PID 2684 wrote to memory of 3728 2684 6522.tmp 6590.tmp PID 2684 wrote to memory of 3728 2684 6522.tmp 6590.tmp PID 3728 wrote to memory of 1956 3728 6590.tmp 65DE.tmp PID 3728 wrote to memory of 1956 3728 6590.tmp 65DE.tmp PID 3728 wrote to memory of 1956 3728 6590.tmp 65DE.tmp PID 1956 wrote to memory of 528 1956 65DE.tmp 667A.tmp PID 1956 wrote to memory of 528 1956 65DE.tmp 667A.tmp PID 1956 wrote to memory of 528 1956 65DE.tmp 667A.tmp PID 528 wrote to memory of 5104 528 667A.tmp 66D8.tmp PID 528 wrote to memory of 5104 528 667A.tmp 66D8.tmp PID 528 wrote to memory of 5104 528 667A.tmp 66D8.tmp PID 5104 wrote to memory of 4184 5104 66D8.tmp 6726.tmp PID 5104 wrote to memory of 4184 5104 66D8.tmp 6726.tmp PID 5104 wrote to memory of 4184 5104 66D8.tmp 6726.tmp PID 4184 wrote to memory of 336 4184 6726.tmp 67A3.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ef0bc6d25aca144eb3098564aa293212_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\5F08.tmp"C:\Users\Admin\AppData\Local\Temp\5F08.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\6050.tmp"C:\Users\Admin\AppData\Local\Temp\6050.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\60BD.tmp"C:\Users\Admin\AppData\Local\Temp\60BD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\61B7.tmp"C:\Users\Admin\AppData\Local\Temp\61B7.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\6234.tmp"C:\Users\Admin\AppData\Local\Temp\6234.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\6300.tmp"C:\Users\Admin\AppData\Local\Temp\6300.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\635D.tmp"C:\Users\Admin\AppData\Local\Temp\635D.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\63AB.tmp"C:\Users\Admin\AppData\Local\Temp\63AB.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\64C5.tmp"C:\Users\Admin\AppData\Local\Temp\64C5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3564 -
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Users\Admin\AppData\Local\Temp\6590.tmp"C:\Users\Admin\AppData\Local\Temp\6590.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:528 -
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\67A3.tmp"C:\Users\Admin\AppData\Local\Temp\67A3.tmp"23⤵
- Executes dropped EXE
PID:336 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"24⤵
- Executes dropped EXE
PID:400 -
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"25⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"26⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\6949.tmp"C:\Users\Admin\AppData\Local\Temp\6949.tmp"27⤵
- Executes dropped EXE
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"28⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\6A33.tmp"C:\Users\Admin\AppData\Local\Temp\6A33.tmp"29⤵
- Executes dropped EXE
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"C:\Users\Admin\AppData\Local\Temp\6AA1.tmp"30⤵
- Executes dropped EXE
PID:4476 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"31⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"C:\Users\Admin\AppData\Local\Temp\6B7B.tmp"32⤵
- Executes dropped EXE
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"33⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"34⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"35⤵
- Executes dropped EXE
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"36⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\6D50.tmp"C:\Users\Admin\AppData\Local\Temp\6D50.tmp"37⤵
- Executes dropped EXE
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"C:\Users\Admin\AppData\Local\Temp\6D9E.tmp"38⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"39⤵
- Executes dropped EXE
PID:1520 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"40⤵
- Executes dropped EXE
PID:544 -
C:\Users\Admin\AppData\Local\Temp\6E89.tmp"C:\Users\Admin\AppData\Local\Temp\6E89.tmp"41⤵
- Executes dropped EXE
PID:3940 -
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"42⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"43⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"44⤵
- Executes dropped EXE
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"C:\Users\Admin\AppData\Local\Temp\6FE0.tmp"45⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\702F.tmp"C:\Users\Admin\AppData\Local\Temp\702F.tmp"46⤵
- Executes dropped EXE
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\707D.tmp"C:\Users\Admin\AppData\Local\Temp\707D.tmp"47⤵
- Executes dropped EXE
PID:1744 -
C:\Users\Admin\AppData\Local\Temp\70DA.tmp"C:\Users\Admin\AppData\Local\Temp\70DA.tmp"48⤵
- Executes dropped EXE
PID:3260 -
C:\Users\Admin\AppData\Local\Temp\7129.tmp"C:\Users\Admin\AppData\Local\Temp\7129.tmp"49⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\7186.tmp"C:\Users\Admin\AppData\Local\Temp\7186.tmp"50⤵
- Executes dropped EXE
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"51⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\7223.tmp"C:\Users\Admin\AppData\Local\Temp\7223.tmp"52⤵
- Executes dropped EXE
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"53⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"54⤵
- Executes dropped EXE
PID:316 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"55⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"56⤵
- Executes dropped EXE
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\73A9.tmp"C:\Users\Admin\AppData\Local\Temp\73A9.tmp"57⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"58⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"59⤵
- Executes dropped EXE
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"60⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"61⤵
- Executes dropped EXE
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\754F.tmp"C:\Users\Admin\AppData\Local\Temp\754F.tmp"62⤵
- Executes dropped EXE
PID:5036 -
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"63⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\75FB.tmp"C:\Users\Admin\AppData\Local\Temp\75FB.tmp"64⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\7659.tmp"C:\Users\Admin\AppData\Local\Temp\7659.tmp"65⤵
- Executes dropped EXE
PID:4160 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"66⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\7714.tmp"C:\Users\Admin\AppData\Local\Temp\7714.tmp"67⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\7772.tmp"C:\Users\Admin\AppData\Local\Temp\7772.tmp"68⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\77C0.tmp"C:\Users\Admin\AppData\Local\Temp\77C0.tmp"69⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"70⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\786C.tmp"C:\Users\Admin\AppData\Local\Temp\786C.tmp"71⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\78BA.tmp"C:\Users\Admin\AppData\Local\Temp\78BA.tmp"72⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\7908.tmp"C:\Users\Admin\AppData\Local\Temp\7908.tmp"73⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\7956.tmp"C:\Users\Admin\AppData\Local\Temp\7956.tmp"74⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\79C4.tmp"C:\Users\Admin\AppData\Local\Temp\79C4.tmp"75⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"76⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"C:\Users\Admin\AppData\Local\Temp\7A7F.tmp"77⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"C:\Users\Admin\AppData\Local\Temp\7ACD.tmp"78⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"79⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\7B89.tmp"C:\Users\Admin\AppData\Local\Temp\7B89.tmp"80⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"C:\Users\Admin\AppData\Local\Temp\7BE7.tmp"81⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"82⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"C:\Users\Admin\AppData\Local\Temp\7CA2.tmp"83⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"84⤵PID:3788
-
C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"C:\Users\Admin\AppData\Local\Temp\7D4E.tmp"85⤵PID:5024
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"86⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"87⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\7E67.tmp"C:\Users\Admin\AppData\Local\Temp\7E67.tmp"88⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"C:\Users\Admin\AppData\Local\Temp\7EC5.tmp"89⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\7F23.tmp"C:\Users\Admin\AppData\Local\Temp\7F23.tmp"90⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\7F80.tmp"C:\Users\Admin\AppData\Local\Temp\7F80.tmp"91⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"C:\Users\Admin\AppData\Local\Temp\7FDE.tmp"92⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\803C.tmp"C:\Users\Admin\AppData\Local\Temp\803C.tmp"93⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\808A.tmp"C:\Users\Admin\AppData\Local\Temp\808A.tmp"94⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\80E8.tmp"C:\Users\Admin\AppData\Local\Temp\80E8.tmp"95⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\8136.tmp"C:\Users\Admin\AppData\Local\Temp\8136.tmp"96⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\8194.tmp"C:\Users\Admin\AppData\Local\Temp\8194.tmp"97⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\81F1.tmp"C:\Users\Admin\AppData\Local\Temp\81F1.tmp"98⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\824F.tmp"C:\Users\Admin\AppData\Local\Temp\824F.tmp"99⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\829D.tmp"C:\Users\Admin\AppData\Local\Temp\829D.tmp"100⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\82FB.tmp"C:\Users\Admin\AppData\Local\Temp\82FB.tmp"101⤵PID:4736
-
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"102⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"103⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"104⤵PID:4648
-
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"105⤵PID:3940
-
C:\Users\Admin\AppData\Local\Temp\84D0.tmp"C:\Users\Admin\AppData\Local\Temp\84D0.tmp"106⤵PID:3968
-
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"107⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\858B.tmp"C:\Users\Admin\AppData\Local\Temp\858B.tmp"108⤵PID:3348
-
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"109⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"110⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"111⤵PID:4500
-
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"112⤵PID:1908
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"113⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"114⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"115⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"116⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\8879.tmp"C:\Users\Admin\AppData\Local\Temp\8879.tmp"117⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"118⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\8935.tmp"C:\Users\Admin\AppData\Local\Temp\8935.tmp"119⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\8993.tmp"C:\Users\Admin\AppData\Local\Temp\8993.tmp"120⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"121⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"C:\Users\Admin\AppData\Local\Temp\8A3E.tmp"122⤵PID:1768
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-