Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
25-05-2024 11:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe
Resource
win7-20240215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe
-
Size
520KB
-
MD5
78dcfcb0ff617614728c5535fd2659bb
-
SHA1
f6f0d7e2a57fd51f05855347ec6c029ee8c89708
-
SHA256
78c6667e078da5c1543dea3e82f2a7ebdab30a2e916549102f5bd1e07a070032
-
SHA512
11ac57c9c9e32cda8bd938e330b653ef679fca7c9b0c6cf6401280678774441efc4038bbfd80349333c22e602d428a1fcaa518a2045381e8473589abe398b229
-
SSDEEP
12288:roRXOQjmOy0ncxfHammopCoPecwIlDeWOSpRSXP0qNZ:rogQ9y0cxfHD1pCieLIly2pssqN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1080 5709.tmp 1144 57A5.tmp 1348 5822.tmp 1056 58BF.tmp 1676 593C.tmp 2060 59C8.tmp 1632 5A64.tmp 2316 5AF1.tmp 3592 5B5E.tmp 4296 5C0A.tmp 4708 5C87.tmp 452 5D04.tmp 2832 5D62.tmp 2820 5DDF.tmp 824 5E5C.tmp 1900 5ED9.tmp 1496 5F46.tmp 4532 5FA4.tmp 712 6040.tmp 3120 60AE.tmp 4988 613A.tmp 976 6198.tmp 2204 6215.tmp 2868 6292.tmp 3784 630F.tmp 2236 637D.tmp 4144 6409.tmp 3224 6496.tmp 4092 6513.tmp 4156 659F.tmp 2200 65FD.tmp 4324 665B.tmp 4920 66B9.tmp 216 6707.tmp 4956 6765.tmp 3980 67B3.tmp 1076 6801.tmp 2360 684F.tmp 3788 68AD.tmp 2732 690A.tmp 1400 6968.tmp 1868 69D6.tmp 5060 6A24.tmp 2060 6A72.tmp 4952 6AD0.tmp 488 6B3D.tmp 3808 6B9B.tmp 3052 6BF8.tmp 4836 6C47.tmp 2000 6CB4.tmp 2800 6D02.tmp 4796 6D60.tmp 1232 6DBE.tmp 2952 6E1B.tmp 2888 6E69.tmp 1496 6EC7.tmp 708 6F35.tmp 1660 6F92.tmp 712 7000.tmp 3324 704E.tmp 4904 70BB.tmp 2580 7119.tmp 2388 7177.tmp 3088 71D4.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3788 wrote to memory of 1080 3788 2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe 83 PID 3788 wrote to memory of 1080 3788 2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe 83 PID 3788 wrote to memory of 1080 3788 2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe 83 PID 1080 wrote to memory of 1144 1080 5709.tmp 84 PID 1080 wrote to memory of 1144 1080 5709.tmp 84 PID 1080 wrote to memory of 1144 1080 5709.tmp 84 PID 1144 wrote to memory of 1348 1144 57A5.tmp 85 PID 1144 wrote to memory of 1348 1144 57A5.tmp 85 PID 1144 wrote to memory of 1348 1144 57A5.tmp 85 PID 1348 wrote to memory of 1056 1348 5822.tmp 86 PID 1348 wrote to memory of 1056 1348 5822.tmp 86 PID 1348 wrote to memory of 1056 1348 5822.tmp 86 PID 1056 wrote to memory of 1676 1056 58BF.tmp 88 PID 1056 wrote to memory of 1676 1056 58BF.tmp 88 PID 1056 wrote to memory of 1676 1056 58BF.tmp 88 PID 1676 wrote to memory of 2060 1676 593C.tmp 90 PID 1676 wrote to memory of 2060 1676 593C.tmp 90 PID 1676 wrote to memory of 2060 1676 593C.tmp 90 PID 2060 wrote to memory of 1632 2060 59C8.tmp 91 PID 2060 wrote to memory of 1632 2060 59C8.tmp 91 PID 2060 wrote to memory of 1632 2060 59C8.tmp 91 PID 1632 wrote to memory of 2316 1632 5A64.tmp 93 PID 1632 wrote to memory of 2316 1632 5A64.tmp 93 PID 1632 wrote to memory of 2316 1632 5A64.tmp 93 PID 2316 wrote to memory of 3592 2316 5AF1.tmp 94 PID 2316 wrote to memory of 3592 2316 5AF1.tmp 94 PID 2316 wrote to memory of 3592 2316 5AF1.tmp 94 PID 3592 wrote to memory of 4296 3592 5B5E.tmp 95 PID 3592 wrote to memory of 4296 3592 5B5E.tmp 95 PID 3592 wrote to memory of 4296 3592 5B5E.tmp 95 PID 4296 wrote to memory of 4708 4296 5C0A.tmp 96 PID 4296 wrote to memory of 4708 4296 5C0A.tmp 96 PID 4296 wrote to memory of 4708 4296 5C0A.tmp 96 PID 4708 wrote to memory of 452 4708 5C87.tmp 97 PID 4708 wrote to memory of 452 4708 5C87.tmp 97 PID 4708 wrote to memory of 452 4708 5C87.tmp 97 PID 452 wrote to memory of 2832 452 5D04.tmp 98 PID 452 wrote to memory of 2832 452 5D04.tmp 98 PID 452 wrote to memory of 2832 452 5D04.tmp 98 PID 2832 wrote to memory of 2820 2832 5D62.tmp 99 PID 2832 wrote to memory of 2820 2832 5D62.tmp 99 PID 2832 wrote to memory of 2820 2832 5D62.tmp 99 PID 2820 wrote to memory of 824 2820 5DDF.tmp 100 PID 2820 wrote to memory of 824 2820 5DDF.tmp 100 PID 2820 wrote to memory of 824 2820 5DDF.tmp 100 PID 824 wrote to memory of 1900 824 5E5C.tmp 101 PID 824 wrote to memory of 1900 824 5E5C.tmp 101 PID 824 wrote to memory of 1900 824 5E5C.tmp 101 PID 1900 wrote to memory of 1496 1900 5ED9.tmp 102 PID 1900 wrote to memory of 1496 1900 5ED9.tmp 102 PID 1900 wrote to memory of 1496 1900 5ED9.tmp 102 PID 1496 wrote to memory of 4532 1496 5F46.tmp 103 PID 1496 wrote to memory of 4532 1496 5F46.tmp 103 PID 1496 wrote to memory of 4532 1496 5F46.tmp 103 PID 4532 wrote to memory of 712 4532 5FA4.tmp 104 PID 4532 wrote to memory of 712 4532 5FA4.tmp 104 PID 4532 wrote to memory of 712 4532 5FA4.tmp 104 PID 712 wrote to memory of 3120 712 6040.tmp 105 PID 712 wrote to memory of 3120 712 6040.tmp 105 PID 712 wrote to memory of 3120 712 6040.tmp 105 PID 3120 wrote to memory of 4988 3120 60AE.tmp 106 PID 3120 wrote to memory of 4988 3120 60AE.tmp 106 PID 3120 wrote to memory of 4988 3120 60AE.tmp 106 PID 4988 wrote to memory of 976 4988 613A.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_78dcfcb0ff617614728c5535fd2659bb_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\58BF.tmp"C:\Users\Admin\AppData\Local\Temp\58BF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\5F46.tmp"C:\Users\Admin\AppData\Local\Temp\5F46.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"C:\Users\Admin\AppData\Local\Temp\5FA4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:712 -
C:\Users\Admin\AppData\Local\Temp\60AE.tmp"C:\Users\Admin\AppData\Local\Temp\60AE.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\613A.tmp"C:\Users\Admin\AppData\Local\Temp\613A.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\6198.tmp"C:\Users\Admin\AppData\Local\Temp\6198.tmp"23⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\6215.tmp"C:\Users\Admin\AppData\Local\Temp\6215.tmp"24⤵
- Executes dropped EXE
PID:2204 -
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"25⤵
- Executes dropped EXE
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"26⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"27⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"28⤵
- Executes dropped EXE
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\6496.tmp"C:\Users\Admin\AppData\Local\Temp\6496.tmp"29⤵
- Executes dropped EXE
PID:3224 -
C:\Users\Admin\AppData\Local\Temp\6513.tmp"C:\Users\Admin\AppData\Local\Temp\6513.tmp"30⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"31⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"32⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"33⤵
- Executes dropped EXE
PID:4324 -
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"34⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"35⤵
- Executes dropped EXE
PID:216 -
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"36⤵
- Executes dropped EXE
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"37⤵
- Executes dropped EXE
PID:3980 -
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"38⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"39⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\68AD.tmp"C:\Users\Admin\AppData\Local\Temp\68AD.tmp"40⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\690A.tmp"C:\Users\Admin\AppData\Local\Temp\690A.tmp"41⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\6968.tmp"C:\Users\Admin\AppData\Local\Temp\6968.tmp"42⤵
- Executes dropped EXE
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"43⤵
- Executes dropped EXE
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"44⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"45⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"46⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"C:\Users\Admin\AppData\Local\Temp\6B3D.tmp"47⤵
- Executes dropped EXE
PID:488 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"48⤵
- Executes dropped EXE
PID:3808 -
C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"C:\Users\Admin\AppData\Local\Temp\6BF8.tmp"49⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"50⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"C:\Users\Admin\AppData\Local\Temp\6CB4.tmp"51⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"52⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"53⤵
- Executes dropped EXE
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"C:\Users\Admin\AppData\Local\Temp\6DBE.tmp"54⤵
- Executes dropped EXE
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"C:\Users\Admin\AppData\Local\Temp\6E1B.tmp"55⤵
- Executes dropped EXE
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\6E69.tmp"C:\Users\Admin\AppData\Local\Temp\6E69.tmp"56⤵
- Executes dropped EXE
PID:2888 -
C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"C:\Users\Admin\AppData\Local\Temp\6EC7.tmp"57⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"58⤵
- Executes dropped EXE
PID:708 -
C:\Users\Admin\AppData\Local\Temp\6F92.tmp"C:\Users\Admin\AppData\Local\Temp\6F92.tmp"59⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\7000.tmp"C:\Users\Admin\AppData\Local\Temp\7000.tmp"60⤵
- Executes dropped EXE
PID:712 -
C:\Users\Admin\AppData\Local\Temp\704E.tmp"C:\Users\Admin\AppData\Local\Temp\704E.tmp"61⤵
- Executes dropped EXE
PID:3324 -
C:\Users\Admin\AppData\Local\Temp\70BB.tmp"C:\Users\Admin\AppData\Local\Temp\70BB.tmp"62⤵
- Executes dropped EXE
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"63⤵
- Executes dropped EXE
PID:2580 -
C:\Users\Admin\AppData\Local\Temp\7177.tmp"C:\Users\Admin\AppData\Local\Temp\7177.tmp"64⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\71D4.tmp"C:\Users\Admin\AppData\Local\Temp\71D4.tmp"65⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\7242.tmp"C:\Users\Admin\AppData\Local\Temp\7242.tmp"66⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\72AF.tmp"C:\Users\Admin\AppData\Local\Temp\72AF.tmp"67⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"68⤵PID:700
-
C:\Users\Admin\AppData\Local\Temp\738A.tmp"C:\Users\Admin\AppData\Local\Temp\738A.tmp"69⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\73F7.tmp"C:\Users\Admin\AppData\Local\Temp\73F7.tmp"70⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"71⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\74D2.tmp"C:\Users\Admin\AppData\Local\Temp\74D2.tmp"72⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\753F.tmp"C:\Users\Admin\AppData\Local\Temp\753F.tmp"73⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\759D.tmp"C:\Users\Admin\AppData\Local\Temp\759D.tmp"74⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"75⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"76⤵PID:4980
-
C:\Users\Admin\AppData\Local\Temp\76D6.tmp"C:\Users\Admin\AppData\Local\Temp\76D6.tmp"77⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\7733.tmp"C:\Users\Admin\AppData\Local\Temp\7733.tmp"78⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\77A1.tmp"C:\Users\Admin\AppData\Local\Temp\77A1.tmp"79⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"80⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\787C.tmp"C:\Users\Admin\AppData\Local\Temp\787C.tmp"81⤵PID:3276
-
C:\Users\Admin\AppData\Local\Temp\78D9.tmp"C:\Users\Admin\AppData\Local\Temp\78D9.tmp"82⤵PID:4912
-
C:\Users\Admin\AppData\Local\Temp\7947.tmp"C:\Users\Admin\AppData\Local\Temp\7947.tmp"83⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\79B4.tmp"C:\Users\Admin\AppData\Local\Temp\79B4.tmp"84⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"85⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"C:\Users\Admin\AppData\Local\Temp\7A8F.tmp"86⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"C:\Users\Admin\AppData\Local\Temp\7AFC.tmp"87⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"C:\Users\Admin\AppData\Local\Temp\7B6A.tmp"88⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"C:\Users\Admin\AppData\Local\Temp\7BD7.tmp"89⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\7C35.tmp"C:\Users\Admin\AppData\Local\Temp\7C35.tmp"90⤵PID:4640
-
C:\Users\Admin\AppData\Local\Temp\7C92.tmp"C:\Users\Admin\AppData\Local\Temp\7C92.tmp"91⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\7D00.tmp"C:\Users\Admin\AppData\Local\Temp\7D00.tmp"92⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"C:\Users\Admin\AppData\Local\Temp\7D5E.tmp"93⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"94⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\7E09.tmp"C:\Users\Admin\AppData\Local\Temp\7E09.tmp"95⤵PID:4108
-
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"96⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"C:\Users\Admin\AppData\Local\Temp\7EA6.tmp"97⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\7F03.tmp"C:\Users\Admin\AppData\Local\Temp\7F03.tmp"98⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\7F52.tmp"C:\Users\Admin\AppData\Local\Temp\7F52.tmp"99⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"C:\Users\Admin\AppData\Local\Temp\7FA0.tmp"100⤵PID:884
-
C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"C:\Users\Admin\AppData\Local\Temp\7FEE.tmp"101⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\805B.tmp"C:\Users\Admin\AppData\Local\Temp\805B.tmp"102⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\80C9.tmp"C:\Users\Admin\AppData\Local\Temp\80C9.tmp"103⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\8126.tmp"C:\Users\Admin\AppData\Local\Temp\8126.tmp"104⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\8184.tmp"C:\Users\Admin\AppData\Local\Temp\8184.tmp"105⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\81D2.tmp"C:\Users\Admin\AppData\Local\Temp\81D2.tmp"106⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\8220.tmp"C:\Users\Admin\AppData\Local\Temp\8220.tmp"107⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\827E.tmp"C:\Users\Admin\AppData\Local\Temp\827E.tmp"108⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"109⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"110⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"111⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\8414.tmp"C:\Users\Admin\AppData\Local\Temp\8414.tmp"112⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"113⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\84DF.tmp"C:\Users\Admin\AppData\Local\Temp\84DF.tmp"114⤵PID:3248
-
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"115⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\85AB.tmp"C:\Users\Admin\AppData\Local\Temp\85AB.tmp"116⤵PID:4144
-
C:\Users\Admin\AppData\Local\Temp\8618.tmp"C:\Users\Admin\AppData\Local\Temp\8618.tmp"117⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"118⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\86E3.tmp"C:\Users\Admin\AppData\Local\Temp\86E3.tmp"119⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"120⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"121⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\87DD.tmp"C:\Users\Admin\AppData\Local\Temp\87DD.tmp"122⤵PID:4324
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-