Analysis
-
max time kernel
150s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
11/02/2024, 11:24
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-11_478098507921e80127970c98815e23d6_mafia.exe
Resource
win7-20231129-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-11_478098507921e80127970c98815e23d6_mafia.exe
Resource
win10v2004-20231215-en
2 signatures
150 seconds
General
-
Target
2024-02-11_478098507921e80127970c98815e23d6_mafia.exe
-
Size
488KB
-
MD5
478098507921e80127970c98815e23d6
-
SHA1
58e1689a0c2c186f482a834cb3161d89dee0a26f
-
SHA256
6147c0a1ecea2673e8434f1cc32e415759b656b6edbc3e6e40d72e599e44be5c
-
SHA512
1aa7480ca2fb8c42169fbafc53c26ca41d1cf2a7cb33459838223ae81acde78b198dd9048ffbccf810019ec38fe91d46adf6dbf1e4a25a993e9c7844e5b837c2
-
SSDEEP
12288:/U5rCOTeiD4Z+zNHjp6anxpDPFheGLLqS5NZ:/UQOJDw6Dp6arDjeGXDN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 320 C02.tmp 2740 C40.tmp 940 C9E.tmp 2160 CFC.tmp 2748 D4A.tmp 2676 D88.tmp 2868 DD6.tmp 2656 E24.tmp 1568 E72.tmp 1904 EC0.tmp 2520 EFE.tmp 2504 F3D.tmp 2000 FAA.tmp 2084 FF8.tmp 2188 1036.tmp 2832 1075.tmp 1328 10D2.tmp 2788 1130.tmp 1664 116E.tmp 2756 11BC.tmp 2812 11FB.tmp 1120 1249.tmp 500 1287.tmp 2976 12D5.tmp 2952 1314.tmp 2284 1342.tmp 1868 1381.tmp 2324 13BF.tmp 2248 13FE.tmp 268 143C.tmp 488 147A.tmp 1068 14B9.tmp 1508 1536.tmp 584 15A3.tmp 1864 1620.tmp 2348 165E.tmp 2416 169C.tmp 2424 16EA.tmp 2136 1729.tmp 1480 1777.tmp 1820 17B5.tmp 1260 17F4.tmp 616 1832.tmp 2132 1870.tmp 2440 18AF.tmp 972 18ED.tmp 2436 192C.tmp 1644 196A.tmp 2076 19A8.tmp 2872 19E7.tmp 1636 1A25.tmp 2908 1A64.tmp 2212 1AA2.tmp 3012 1AE0.tmp 2376 1B1F.tmp 1652 1B5D.tmp 2184 1B9C.tmp 2372 1BEA.tmp 2064 1C28.tmp 3048 1C66.tmp 940 1CA5.tmp 2552 1CE3.tmp 2092 1D22.tmp 2704 1D60.tmp -
Loads dropped DLL 64 IoCs
pid Process 2316 2024-02-11_478098507921e80127970c98815e23d6_mafia.exe 320 C02.tmp 2740 C40.tmp 940 C9E.tmp 2160 CFC.tmp 2748 D4A.tmp 2676 D88.tmp 2868 DD6.tmp 2656 E24.tmp 1568 E72.tmp 1904 EC0.tmp 2520 EFE.tmp 2504 F3D.tmp 2000 FAA.tmp 2084 FF8.tmp 2188 1036.tmp 2832 1075.tmp 1328 10D2.tmp 2788 1130.tmp 1664 116E.tmp 2756 11BC.tmp 2812 11FB.tmp 1120 1249.tmp 500 1287.tmp 2976 12D5.tmp 2952 1314.tmp 2284 1342.tmp 1868 1381.tmp 2324 13BF.tmp 2248 13FE.tmp 268 143C.tmp 488 147A.tmp 1068 14B9.tmp 1508 1536.tmp 584 15A3.tmp 1864 1620.tmp 2348 165E.tmp 2416 169C.tmp 2424 16EA.tmp 2136 1729.tmp 1480 1777.tmp 1820 17B5.tmp 1260 17F4.tmp 616 1832.tmp 2132 1870.tmp 2440 18AF.tmp 972 18ED.tmp 2436 192C.tmp 1644 196A.tmp 2076 19A8.tmp 2872 19E7.tmp 1636 1A25.tmp 2908 1A64.tmp 2212 1AA2.tmp 3012 1AE0.tmp 2376 1B1F.tmp 1652 1B5D.tmp 2184 1B9C.tmp 2372 1BEA.tmp 2064 1C28.tmp 3048 1C66.tmp 940 1CA5.tmp 2552 1CE3.tmp 2092 1D22.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2316 wrote to memory of 320 2316 2024-02-11_478098507921e80127970c98815e23d6_mafia.exe 28 PID 2316 wrote to memory of 320 2316 2024-02-11_478098507921e80127970c98815e23d6_mafia.exe 28 PID 2316 wrote to memory of 320 2316 2024-02-11_478098507921e80127970c98815e23d6_mafia.exe 28 PID 2316 wrote to memory of 320 2316 2024-02-11_478098507921e80127970c98815e23d6_mafia.exe 28 PID 320 wrote to memory of 2740 320 C02.tmp 29 PID 320 wrote to memory of 2740 320 C02.tmp 29 PID 320 wrote to memory of 2740 320 C02.tmp 29 PID 320 wrote to memory of 2740 320 C02.tmp 29 PID 2740 wrote to memory of 940 2740 C40.tmp 30 PID 2740 wrote to memory of 940 2740 C40.tmp 30 PID 2740 wrote to memory of 940 2740 C40.tmp 30 PID 2740 wrote to memory of 940 2740 C40.tmp 30 PID 940 wrote to memory of 2160 940 C9E.tmp 31 PID 940 wrote to memory of 2160 940 C9E.tmp 31 PID 940 wrote to memory of 2160 940 C9E.tmp 31 PID 940 wrote to memory of 2160 940 C9E.tmp 31 PID 2160 wrote to memory of 2748 2160 CFC.tmp 32 PID 2160 wrote to memory of 2748 2160 CFC.tmp 32 PID 2160 wrote to memory of 2748 2160 CFC.tmp 32 PID 2160 wrote to memory of 2748 2160 CFC.tmp 32 PID 2748 wrote to memory of 2676 2748 D4A.tmp 33 PID 2748 wrote to memory of 2676 2748 D4A.tmp 33 PID 2748 wrote to memory of 2676 2748 D4A.tmp 33 PID 2748 wrote to memory of 2676 2748 D4A.tmp 33 PID 2676 wrote to memory of 2868 2676 D88.tmp 34 PID 2676 wrote to memory of 2868 2676 D88.tmp 34 PID 2676 wrote to memory of 2868 2676 D88.tmp 34 PID 2676 wrote to memory of 2868 2676 D88.tmp 34 PID 2868 wrote to memory of 2656 2868 DD6.tmp 35 PID 2868 wrote to memory of 2656 2868 DD6.tmp 35 PID 2868 wrote to memory of 2656 2868 DD6.tmp 35 PID 2868 wrote to memory of 2656 2868 DD6.tmp 35 PID 2656 wrote to memory of 1568 2656 E24.tmp 55 PID 2656 wrote to memory of 1568 2656 E24.tmp 55 PID 2656 wrote to memory of 1568 2656 E24.tmp 55 PID 2656 wrote to memory of 1568 2656 E24.tmp 55 PID 1568 wrote to memory of 1904 1568 E72.tmp 54 PID 1568 wrote to memory of 1904 1568 E72.tmp 54 PID 1568 wrote to memory of 1904 1568 E72.tmp 54 PID 1568 wrote to memory of 1904 1568 E72.tmp 54 PID 1904 wrote to memory of 2520 1904 EC0.tmp 36 PID 1904 wrote to memory of 2520 1904 EC0.tmp 36 PID 1904 wrote to memory of 2520 1904 EC0.tmp 36 PID 1904 wrote to memory of 2520 1904 EC0.tmp 36 PID 2520 wrote to memory of 2504 2520 EFE.tmp 37 PID 2520 wrote to memory of 2504 2520 EFE.tmp 37 PID 2520 wrote to memory of 2504 2520 EFE.tmp 37 PID 2520 wrote to memory of 2504 2520 EFE.tmp 37 PID 2504 wrote to memory of 2000 2504 F3D.tmp 38 PID 2504 wrote to memory of 2000 2504 F3D.tmp 38 PID 2504 wrote to memory of 2000 2504 F3D.tmp 38 PID 2504 wrote to memory of 2000 2504 F3D.tmp 38 PID 2000 wrote to memory of 2084 2000 FAA.tmp 39 PID 2000 wrote to memory of 2084 2000 FAA.tmp 39 PID 2000 wrote to memory of 2084 2000 FAA.tmp 39 PID 2000 wrote to memory of 2084 2000 FAA.tmp 39 PID 2084 wrote to memory of 2188 2084 FF8.tmp 42 PID 2084 wrote to memory of 2188 2084 FF8.tmp 42 PID 2084 wrote to memory of 2188 2084 FF8.tmp 42 PID 2084 wrote to memory of 2188 2084 FF8.tmp 42 PID 2188 wrote to memory of 2832 2188 1036.tmp 41 PID 2188 wrote to memory of 2832 2188 1036.tmp 41 PID 2188 wrote to memory of 2832 2188 1036.tmp 41 PID 2188 wrote to memory of 2832 2188 1036.tmp 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-11_478098507921e80127970c98815e23d6_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-11_478098507921e80127970c98815e23d6_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\C02.tmp"C:\Users\Admin\AppData\Local\Temp\C02.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\CFC.tmp"C:\Users\Admin\AppData\Local\Temp\CFC.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\D4A.tmp"C:\Users\Admin\AppData\Local\Temp\D4A.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\D88.tmp"C:\Users\Admin\AppData\Local\Temp\D88.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\DD6.tmp"C:\Users\Admin\AppData\Local\Temp\DD6.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868 -
C:\Users\Admin\AppData\Local\Temp\E24.tmp"C:\Users\Admin\AppData\Local\Temp\E24.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\E72.tmp"C:\Users\Admin\AppData\Local\Temp\E72.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568
-
-
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\F3D.tmp"C:\Users\Admin\AppData\Local\Temp\F3D.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\FAA.tmp"C:\Users\Admin\AppData\Local\Temp\FAA.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\FF8.tmp"C:\Users\Admin\AppData\Local\Temp\FF8.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\1036.tmp"C:\Users\Admin\AppData\Local\Temp\1036.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\10D2.tmp"C:\Users\Admin\AppData\Local\Temp\10D2.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2788
-
-
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2832
-
C:\Users\Admin\AppData\Local\Temp\116E.tmp"C:\Users\Admin\AppData\Local\Temp\116E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\11BC.tmp"C:\Users\Admin\AppData\Local\Temp\11BC.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\1287.tmp"C:\Users\Admin\AppData\Local\Temp\1287.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:500 -
C:\Users\Admin\AppData\Local\Temp\12D5.tmp"C:\Users\Admin\AppData\Local\Temp\12D5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\1314.tmp"C:\Users\Admin\AppData\Local\Temp\1314.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\1342.tmp"C:\Users\Admin\AppData\Local\Temp\1342.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\1381.tmp"C:\Users\Admin\AppData\Local\Temp\1381.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:488 -
C:\Users\Admin\AppData\Local\Temp\14B9.tmp"C:\Users\Admin\AppData\Local\Temp\14B9.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1068 -
C:\Users\Admin\AppData\Local\Temp\1536.tmp"C:\Users\Admin\AppData\Local\Temp\1536.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:584 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\16EA.tmp"C:\Users\Admin\AppData\Local\Temp\16EA.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2424 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\1777.tmp"C:\Users\Admin\AppData\Local\Temp\1777.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\17B5.tmp"C:\Users\Admin\AppData\Local\Temp\17B5.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1820 -
C:\Users\Admin\AppData\Local\Temp\17F4.tmp"C:\Users\Admin\AppData\Local\Temp\17F4.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\1832.tmp"C:\Users\Admin\AppData\Local\Temp\1832.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:616 -
C:\Users\Admin\AppData\Local\Temp\1870.tmp"C:\Users\Admin\AppData\Local\Temp\1870.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\18AF.tmp"C:\Users\Admin\AppData\Local\Temp\18AF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2440 -
C:\Users\Admin\AppData\Local\Temp\18ED.tmp"C:\Users\Admin\AppData\Local\Temp\18ED.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2436 -
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2872 -
C:\Users\Admin\AppData\Local\Temp\1A25.tmp"C:\Users\Admin\AppData\Local\Temp\1A25.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\1A64.tmp"C:\Users\Admin\AppData\Local\Temp\1A64.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2908 -
C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"C:\Users\Admin\AppData\Local\Temp\1AA2.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"C:\Users\Admin\AppData\Local\Temp\1AE0.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"C:\Users\Admin\AppData\Local\Temp\1B1F.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"C:\Users\Admin\AppData\Local\Temp\1BEA.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:940 -
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\1D22.tmp"C:\Users\Admin\AppData\Local\Temp\1D22.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"42⤵
- Executes dropped EXE
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"43⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"44⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"45⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"46⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"47⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"C:\Users\Admin\AppData\Local\Temp\1EF6.tmp"48⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"49⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"50⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"51⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"52⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"53⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"54⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"55⤵PID:2084
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"56⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\2137.tmp"C:\Users\Admin\AppData\Local\Temp\2137.tmp"57⤵PID:2828
-
C:\Users\Admin\AppData\Local\Temp\2175.tmp"C:\Users\Admin\AppData\Local\Temp\2175.tmp"58⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\21B4.tmp"C:\Users\Admin\AppData\Local\Temp\21B4.tmp"59⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\21F2.tmp"C:\Users\Admin\AppData\Local\Temp\21F2.tmp"60⤵PID:2040
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"61⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"62⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"63⤵PID:2004
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"64⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\232A.tmp"C:\Users\Admin\AppData\Local\Temp\232A.tmp"65⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\2368.tmp"C:\Users\Admin\AppData\Local\Temp\2368.tmp"66⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\23B6.tmp"C:\Users\Admin\AppData\Local\Temp\23B6.tmp"67⤵PID:2780
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"68⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"69⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\2481.tmp"C:\Users\Admin\AppData\Local\Temp\2481.tmp"70⤵PID:2940
-
C:\Users\Admin\AppData\Local\Temp\24C0.tmp"C:\Users\Admin\AppData\Local\Temp\24C0.tmp"71⤵PID:932
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"72⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"73⤵PID:2292
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"74⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"75⤵PID:560
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"76⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"77⤵PID:1552
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"78⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"79⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"80⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\274F.tmp"C:\Users\Admin\AppData\Local\Temp\274F.tmp"81⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\278D.tmp"C:\Users\Admin\AppData\Local\Temp\278D.tmp"82⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\27CC.tmp"C:\Users\Admin\AppData\Local\Temp\27CC.tmp"83⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"84⤵PID:2876
-
C:\Users\Admin\AppData\Local\Temp\2848.tmp"C:\Users\Admin\AppData\Local\Temp\2848.tmp"85⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2887.tmp"C:\Users\Admin\AppData\Local\Temp\2887.tmp"86⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\28C5.tmp"C:\Users\Admin\AppData\Local\Temp\28C5.tmp"87⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\2904.tmp"C:\Users\Admin\AppData\Local\Temp\2904.tmp"88⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\2942.tmp"C:\Users\Admin\AppData\Local\Temp\2942.tmp"89⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\2980.tmp"C:\Users\Admin\AppData\Local\Temp\2980.tmp"90⤵PID:280
-
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"91⤵PID:572
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"92⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"93⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"94⤵PID:1744
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"95⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"C:\Users\Admin\AppData\Local\Temp\2AF7.tmp"96⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\2B35.tmp"C:\Users\Admin\AppData\Local\Temp\2B35.tmp"97⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\2B83.tmp"C:\Users\Admin\AppData\Local\Temp\2B83.tmp"98⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"C:\Users\Admin\AppData\Local\Temp\2BC2.tmp"99⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2C00.tmp"C:\Users\Admin\AppData\Local\Temp\2C00.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"101⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"C:\Users\Admin\AppData\Local\Temp\2C6D.tmp"102⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"C:\Users\Admin\AppData\Local\Temp\2CAC.tmp"103⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"C:\Users\Admin\AppData\Local\Temp\2CEA.tmp"104⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\2D28.tmp"C:\Users\Admin\AppData\Local\Temp\2D28.tmp"105⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\2D67.tmp"C:\Users\Admin\AppData\Local\Temp\2D67.tmp"106⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"C:\Users\Admin\AppData\Local\Temp\2DA5.tmp"107⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"C:\Users\Admin\AppData\Local\Temp\2DE4.tmp"108⤵PID:2092
-
C:\Users\Admin\AppData\Local\Temp\2E22.tmp"C:\Users\Admin\AppData\Local\Temp\2E22.tmp"109⤵PID:2704
-
C:\Users\Admin\AppData\Local\Temp\2E60.tmp"C:\Users\Admin\AppData\Local\Temp\2E60.tmp"110⤵PID:2672
-
C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"C:\Users\Admin\AppData\Local\Temp\2E9F.tmp"111⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"112⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"113⤵PID:2464
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"114⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"115⤵PID:2624
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"116⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"117⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"118⤵PID:2572
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"119⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"120⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"121⤵PID:2444
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"122⤵PID:2636
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-