Analysis
-
max time kernel
157s -
max time network
138s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 21:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe
-
Size
486KB
-
MD5
a14bbdeaf9b908f5f2246412ddf8e7cc
-
SHA1
04fcff8dca5f4af8fcbb648ae7a6f3c506410277
-
SHA256
df9da0c6080437490e44ea2a197503b277dcae7f76bd6d744b4ff1a34fe35364
-
SHA512
d5eab46e5de2da4fc49ecda0ad1797f9980d7755f479a0e87d23bc98c76eec7640e867663f5004f47a61970e40f29d81697607a0a7f401f6d55f716073509773
-
SSDEEP
6144:Borf3lPvovsgZnqG2C7mOTeiLfD74RJjUwL7hi8dhgI7eaufiqdb2g0zTkrmcZ7m:oU5rCOTeiD4RLhpzhYcTc5YNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2688 A4B8.tmp 2844 B606.tmp 2396 B673.tmp 2568 B700.tmp 2360 B77D.tmp 1340 B838.tmp 2556 B8C4.tmp 2680 B960.tmp 1444 B9ED.tmp 1428 BA98.tmp 476 BB15.tmp 560 BB92.tmp 2972 BC8B.tmp 1644 BCF9.tmp 2136 BDC3.tmp 2736 BE7F.tmp 2388 BF3A.tmp 2028 BF88.tmp 2856 C043.tmp 1952 C0B0.tmp 1896 C13D.tmp 2960 C19A.tmp 1992 C217.tmp 2012 C294.tmp 1972 C320.tmp 2068 C38D.tmp 1088 C40A.tmp 2892 C4B6.tmp 2344 C513.tmp 3028 C581.tmp 2356 C5EE.tmp 3032 C64B.tmp 2532 C6B9.tmp 1732 C716.tmp 1720 C774.tmp 1076 C7D1.tmp 1924 C82F.tmp 1676 C8DB.tmp 2416 C977.tmp 1408 F5E3.tmp 340 FE9A.tmp 564 3E7.tmp 2492 483.tmp 2216 1584.tmp 1328 20E9.tmp 1592 21C3.tmp 1804 2240.tmp 1708 22BD.tmp 2700 2414.tmp 1196 24EE.tmp 2784 254C.tmp 2760 25D8.tmp 2824 2655.tmp 3008 2720.tmp 2756 278D.tmp 2816 27FA.tmp 2608 2858.tmp 2592 28C5.tmp 2576 2923.tmp 2624 2980.tmp 2108 29DE.tmp 2196 2A4B.tmp 1444 2AB8.tmp 1428 2B16.tmp -
Loads dropped DLL 64 IoCs
pid Process 2744 2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe 2688 A4B8.tmp 2844 B606.tmp 2396 B673.tmp 2568 B700.tmp 2360 B77D.tmp 1340 B838.tmp 2556 B8C4.tmp 2680 B960.tmp 1444 B9ED.tmp 1428 BA98.tmp 476 BB15.tmp 560 BB92.tmp 2972 BC8B.tmp 1644 BCF9.tmp 2136 BDC3.tmp 2736 BE7F.tmp 2388 BF3A.tmp 2028 BF88.tmp 2856 C043.tmp 1952 C0B0.tmp 1896 C13D.tmp 2960 C19A.tmp 1992 C217.tmp 2012 C294.tmp 1972 C320.tmp 2068 C38D.tmp 1088 C40A.tmp 2892 C4B6.tmp 2344 C513.tmp 3028 C581.tmp 2356 C5EE.tmp 3032 C64B.tmp 2532 C6B9.tmp 1732 C716.tmp 1720 C774.tmp 1076 C7D1.tmp 1924 C82F.tmp 1676 C8DB.tmp 2416 C977.tmp 1408 F5E3.tmp 340 FE9A.tmp 564 3E7.tmp 2492 483.tmp 2216 1584.tmp 1328 20E9.tmp 1592 21C3.tmp 1804 2240.tmp 1708 22BD.tmp 2700 2414.tmp 1196 24EE.tmp 2784 254C.tmp 2760 25D8.tmp 2824 2655.tmp 3008 2720.tmp 2756 278D.tmp 2816 27FA.tmp 2608 2858.tmp 2592 28C5.tmp 2576 2923.tmp 2624 2980.tmp 2108 29DE.tmp 2196 2A4B.tmp 1444 2AB8.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2688 2744 2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe 28 PID 2744 wrote to memory of 2688 2744 2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe 28 PID 2744 wrote to memory of 2688 2744 2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe 28 PID 2744 wrote to memory of 2688 2744 2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe 28 PID 2688 wrote to memory of 2844 2688 A4B8.tmp 29 PID 2688 wrote to memory of 2844 2688 A4B8.tmp 29 PID 2688 wrote to memory of 2844 2688 A4B8.tmp 29 PID 2688 wrote to memory of 2844 2688 A4B8.tmp 29 PID 2844 wrote to memory of 2396 2844 B606.tmp 30 PID 2844 wrote to memory of 2396 2844 B606.tmp 30 PID 2844 wrote to memory of 2396 2844 B606.tmp 30 PID 2844 wrote to memory of 2396 2844 B606.tmp 30 PID 2396 wrote to memory of 2568 2396 B673.tmp 31 PID 2396 wrote to memory of 2568 2396 B673.tmp 31 PID 2396 wrote to memory of 2568 2396 B673.tmp 31 PID 2396 wrote to memory of 2568 2396 B673.tmp 31 PID 2568 wrote to memory of 2360 2568 B700.tmp 33 PID 2568 wrote to memory of 2360 2568 B700.tmp 33 PID 2568 wrote to memory of 2360 2568 B700.tmp 33 PID 2568 wrote to memory of 2360 2568 B700.tmp 33 PID 2360 wrote to memory of 1340 2360 B77D.tmp 32 PID 2360 wrote to memory of 1340 2360 B77D.tmp 32 PID 2360 wrote to memory of 1340 2360 B77D.tmp 32 PID 2360 wrote to memory of 1340 2360 B77D.tmp 32 PID 1340 wrote to memory of 2556 1340 B838.tmp 34 PID 1340 wrote to memory of 2556 1340 B838.tmp 34 PID 1340 wrote to memory of 2556 1340 B838.tmp 34 PID 1340 wrote to memory of 2556 1340 B838.tmp 34 PID 2556 wrote to memory of 2680 2556 B8C4.tmp 35 PID 2556 wrote to memory of 2680 2556 B8C4.tmp 35 PID 2556 wrote to memory of 2680 2556 B8C4.tmp 35 PID 2556 wrote to memory of 2680 2556 B8C4.tmp 35 PID 2680 wrote to memory of 1444 2680 B960.tmp 36 PID 2680 wrote to memory of 1444 2680 B960.tmp 36 PID 2680 wrote to memory of 1444 2680 B960.tmp 36 PID 2680 wrote to memory of 1444 2680 B960.tmp 36 PID 1444 wrote to memory of 1428 1444 B9ED.tmp 39 PID 1444 wrote to memory of 1428 1444 B9ED.tmp 39 PID 1444 wrote to memory of 1428 1444 B9ED.tmp 39 PID 1444 wrote to memory of 1428 1444 B9ED.tmp 39 PID 1428 wrote to memory of 476 1428 BA98.tmp 37 PID 1428 wrote to memory of 476 1428 BA98.tmp 37 PID 1428 wrote to memory of 476 1428 BA98.tmp 37 PID 1428 wrote to memory of 476 1428 BA98.tmp 37 PID 476 wrote to memory of 560 476 BB15.tmp 38 PID 476 wrote to memory of 560 476 BB15.tmp 38 PID 476 wrote to memory of 560 476 BB15.tmp 38 PID 476 wrote to memory of 560 476 BB15.tmp 38 PID 560 wrote to memory of 2972 560 BB92.tmp 43 PID 560 wrote to memory of 2972 560 BB92.tmp 43 PID 560 wrote to memory of 2972 560 BB92.tmp 43 PID 560 wrote to memory of 2972 560 BB92.tmp 43 PID 2972 wrote to memory of 1644 2972 BC8B.tmp 40 PID 2972 wrote to memory of 1644 2972 BC8B.tmp 40 PID 2972 wrote to memory of 1644 2972 BC8B.tmp 40 PID 2972 wrote to memory of 1644 2972 BC8B.tmp 40 PID 1644 wrote to memory of 2136 1644 BCF9.tmp 41 PID 1644 wrote to memory of 2136 1644 BCF9.tmp 41 PID 1644 wrote to memory of 2136 1644 BCF9.tmp 41 PID 1644 wrote to memory of 2136 1644 BCF9.tmp 41 PID 2136 wrote to memory of 2736 2136 BDC3.tmp 42 PID 2136 wrote to memory of 2736 2136 BDC3.tmp 42 PID 2136 wrote to memory of 2736 2136 BDC3.tmp 42 PID 2136 wrote to memory of 2736 2136 BDC3.tmp 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_a14bbdeaf9b908f5f2246412ddf8e7cc_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"C:\Users\Admin\AppData\Local\Temp\A4B8.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\B606.tmp"C:\Users\Admin\AppData\Local\Temp\B606.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\B673.tmp"C:\Users\Admin\AppData\Local\Temp\B673.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\B700.tmp"C:\Users\Admin\AppData\Local\Temp\B700.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\B77D.tmp"C:\Users\Admin\AppData\Local\Temp\B77D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B838.tmp"C:\Users\Admin\AppData\Local\Temp\B838.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"C:\Users\Admin\AppData\Local\Temp\B8C4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\B960.tmp"C:\Users\Admin\AppData\Local\Temp\B960.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"C:\Users\Admin\AppData\Local\Temp\B9ED.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\BA98.tmp"C:\Users\Admin\AppData\Local\Temp\BA98.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1428
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BB15.tmp"C:\Users\Admin\AppData\Local\Temp\BB15.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:476 -
C:\Users\Admin\AppData\Local\Temp\BB92.tmp"C:\Users\Admin\AppData\Local\Temp\BB92.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"C:\Users\Admin\AppData\Local\Temp\BC8B.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2972
-
-
-
C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"C:\Users\Admin\AppData\Local\Temp\BCF9.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"C:\Users\Admin\AppData\Local\Temp\BDC3.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"C:\Users\Admin\AppData\Local\Temp\BE7F.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"C:\Users\Admin\AppData\Local\Temp\BF3A.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\BF88.tmp"C:\Users\Admin\AppData\Local\Temp\BF88.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2028
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\C294.tmp"C:\Users\Admin\AppData\Local\Temp\C294.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\C320.tmp"C:\Users\Admin\AppData\Local\Temp\C320.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\C38D.tmp"C:\Users\Admin\AppData\Local\Temp\C38D.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\C40A.tmp"C:\Users\Admin\AppData\Local\Temp\C40A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"C:\Users\Admin\AppData\Local\Temp\C4B6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\C513.tmp"C:\Users\Admin\AppData\Local\Temp\C513.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\C581.tmp"C:\Users\Admin\AppData\Local\Temp\C581.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"C:\Users\Admin\AppData\Local\Temp\C5EE.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2356 -
C:\Users\Admin\AppData\Local\Temp\C64B.tmp"C:\Users\Admin\AppData\Local\Temp\C64B.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"C:\Users\Admin\AppData\Local\Temp\C6B9.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\C716.tmp"C:\Users\Admin\AppData\Local\Temp\C716.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\C774.tmp"C:\Users\Admin\AppData\Local\Temp\C774.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"C:\Users\Admin\AppData\Local\Temp\C7D1.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\C82F.tmp"C:\Users\Admin\AppData\Local\Temp\C82F.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"C:\Users\Admin\AppData\Local\Temp\C8DB.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\C977.tmp"C:\Users\Admin\AppData\Local\Temp\C977.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"C:\Users\Admin\AppData\Local\Temp\F5E3.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"C:\Users\Admin\AppData\Local\Temp\FE9A.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:340 -
C:\Users\Admin\AppData\Local\Temp\3E7.tmp"C:\Users\Admin\AppData\Local\Temp\3E7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:564 -
C:\Users\Admin\AppData\Local\Temp\483.tmp"C:\Users\Admin\AppData\Local\Temp\483.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\1584.tmp"C:\Users\Admin\AppData\Local\Temp\1584.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\20E9.tmp"C:\Users\Admin\AppData\Local\Temp\20E9.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\21C3.tmp"C:\Users\Admin\AppData\Local\Temp\21C3.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\22BD.tmp"C:\Users\Admin\AppData\Local\Temp\22BD.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\24EE.tmp"C:\Users\Admin\AppData\Local\Temp\24EE.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\25D8.tmp"C:\Users\Admin\AppData\Local\Temp\25D8.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\2655.tmp"C:\Users\Admin\AppData\Local\Temp\2655.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2720.tmp"C:\Users\Admin\AppData\Local\Temp\2720.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2592 -
C:\Users\Admin\AppData\Local\Temp\2923.tmp"C:\Users\Admin\AppData\Local\Temp\2923.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624 -
C:\Users\Admin\AppData\Local\Temp\29DE.tmp"C:\Users\Admin\AppData\Local\Temp\29DE.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"C:\Users\Admin\AppData\Local\Temp\2A4B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2196 -
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\2B16.tmp"C:\Users\Admin\AppData\Local\Temp\2B16.tmp"42⤵
- Executes dropped EXE
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\2B74.tmp"C:\Users\Admin\AppData\Local\Temp\2B74.tmp"43⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"44⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"45⤵PID:576
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"46⤵PID:1104
-
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"47⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"48⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"49⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"C:\Users\Admin\AppData\Local\Temp\2F4A.tmp"50⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"C:\Users\Admin\AppData\Local\Temp\2FA8.tmp"51⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"52⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3082.tmp"C:\Users\Admin\AppData\Local\Temp\3082.tmp"53⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"54⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\313E.tmp"C:\Users\Admin\AppData\Local\Temp\313E.tmp"55⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\31AB.tmp"C:\Users\Admin\AppData\Local\Temp\31AB.tmp"56⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"57⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\3266.tmp"C:\Users\Admin\AppData\Local\Temp\3266.tmp"58⤵PID:596
-
C:\Users\Admin\AppData\Local\Temp\32D3.tmp"C:\Users\Admin\AppData\Local\Temp\32D3.tmp"59⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3360.tmp"C:\Users\Admin\AppData\Local\Temp\3360.tmp"60⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\33AE.tmp"C:\Users\Admin\AppData\Local\Temp\33AE.tmp"61⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\341B.tmp"C:\Users\Admin\AppData\Local\Temp\341B.tmp"62⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"C:\Users\Admin\AppData\Local\Temp\5A6F.tmp"63⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\628A.tmp"C:\Users\Admin\AppData\Local\Temp\628A.tmp"64⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\6613.tmp"C:\Users\Admin\AppData\Local\Temp\6613.tmp"65⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"C:\Users\Admin\AppData\Local\Temp\6C3B.tmp"66⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"C:\Users\Admin\AppData\Local\Temp\6CB7.tmp"67⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\6D44.tmp"C:\Users\Admin\AppData\Local\Temp\6D44.tmp"68⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"C:\Users\Admin\AppData\Local\Temp\6DA1.tmp"69⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"C:\Users\Admin\AppData\Local\Temp\6DFF.tmp"70⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"C:\Users\Admin\AppData\Local\Temp\6E6C.tmp"71⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"C:\Users\Admin\AppData\Local\Temp\6ECA.tmp"72⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\6F37.tmp"C:\Users\Admin\AppData\Local\Temp\6F37.tmp"73⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"C:\Users\Admin\AppData\Local\Temp\6FA4.tmp"74⤵PID:1496
-
C:\Users\Admin\AppData\Local\Temp\7002.tmp"C:\Users\Admin\AppData\Local\Temp\7002.tmp"75⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\705F.tmp"C:\Users\Admin\AppData\Local\Temp\705F.tmp"76⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\70BD.tmp"C:\Users\Admin\AppData\Local\Temp\70BD.tmp"77⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\7149.tmp"C:\Users\Admin\AppData\Local\Temp\7149.tmp"78⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\71A7.tmp"C:\Users\Admin\AppData\Local\Temp\71A7.tmp"79⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7205.tmp"C:\Users\Admin\AppData\Local\Temp\7205.tmp"80⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\7262.tmp"C:\Users\Admin\AppData\Local\Temp\7262.tmp"81⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\72CF.tmp"C:\Users\Admin\AppData\Local\Temp\72CF.tmp"82⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"83⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\7465.tmp"C:\Users\Admin\AppData\Local\Temp\7465.tmp"84⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\74C3.tmp"C:\Users\Admin\AppData\Local\Temp\74C3.tmp"85⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\7520.tmp"C:\Users\Admin\AppData\Local\Temp\7520.tmp"86⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\758D.tmp"C:\Users\Admin\AppData\Local\Temp\758D.tmp"87⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"88⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\76C5.tmp"C:\Users\Admin\AppData\Local\Temp\76C5.tmp"89⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\7723.tmp"C:\Users\Admin\AppData\Local\Temp\7723.tmp"90⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\7790.tmp"C:\Users\Admin\AppData\Local\Temp\7790.tmp"91⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\77DE.tmp"C:\Users\Admin\AppData\Local\Temp\77DE.tmp"92⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\785B.tmp"C:\Users\Admin\AppData\Local\Temp\785B.tmp"93⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\78B9.tmp"C:\Users\Admin\AppData\Local\Temp\78B9.tmp"94⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\7916.tmp"C:\Users\Admin\AppData\Local\Temp\7916.tmp"95⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\7983.tmp"C:\Users\Admin\AppData\Local\Temp\7983.tmp"96⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\7B09.tmp"C:\Users\Admin\AppData\Local\Temp\7B09.tmp"97⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\7B67.tmp"C:\Users\Admin\AppData\Local\Temp\7B67.tmp"98⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"C:\Users\Admin\AppData\Local\Temp\7BD4.tmp"99⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\7C32.tmp"C:\Users\Admin\AppData\Local\Temp\7C32.tmp"100⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"C:\Users\Admin\AppData\Local\Temp\7C8F.tmp"101⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\7CED.tmp"C:\Users\Admin\AppData\Local\Temp\7CED.tmp"102⤵PID:2196
-
C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"C:\Users\Admin\AppData\Local\Temp\7D4B.tmp"103⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"C:\Users\Admin\AppData\Local\Temp\7DA8.tmp"104⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"C:\Users\Admin\AppData\Local\Temp\7F5D.tmp"105⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"C:\Users\Admin\AppData\Local\Temp\7FCA.tmp"106⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\94EF.tmp"C:\Users\Admin\AppData\Local\Temp\94EF.tmp"107⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\A351.tmp"C:\Users\Admin\AppData\Local\Temp\A351.tmp"108⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"C:\Users\Admin\AppData\Local\Temp\AB0E.tmp"109⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"C:\Users\Admin\AppData\Local\Temp\AB8B.tmp"110⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"C:\Users\Admin\AppData\Local\Temp\ABF8.tmp"111⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\AC56.tmp"C:\Users\Admin\AppData\Local\Temp\AC56.tmp"112⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"C:\Users\Admin\AppData\Local\Temp\ACC3.tmp"113⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\AD40.tmp"C:\Users\Admin\AppData\Local\Temp\AD40.tmp"114⤵PID:304
-
C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"C:\Users\Admin\AppData\Local\Temp\ADAD.tmp"115⤵PID:868
-
C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"C:\Users\Admin\AppData\Local\Temp\AE2A.tmp"116⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"C:\Users\Admin\AppData\Local\Temp\AEB6.tmp"117⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\AF14.tmp"C:\Users\Admin\AppData\Local\Temp\AF14.tmp"118⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\AF81.tmp"C:\Users\Admin\AppData\Local\Temp\AF81.tmp"119⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"C:\Users\Admin\AppData\Local\Temp\AFEE.tmp"120⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\B05B.tmp"C:\Users\Admin\AppData\Local\Temp\B05B.tmp"121⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"C:\Users\Admin\AppData\Local\Temp\B0B9.tmp"122⤵PID:2012
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-