Analysis
-
max time kernel
150s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 07:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
Resource
win7-20231215-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe
-
Size
520KB
-
MD5
afc815477106f6d600d1a00af5af7917
-
SHA1
956a866473a9cdc05f60c66743b252bb244e6951
-
SHA256
387318e024eb8a13d8cc2eee16d7dc104a5d9dabf4713c24b1063d146021c94b
-
SHA512
492ec703c3779f2ef0f2590863aea9ac954ee426edb8d53ab3a4e9e5d2b69f9634a54f7a9a71426ba9cedd77cf14b819593f73fa6452024d1092211c0d55b04f
-
SSDEEP
12288:roRXOQjmOymaXoOR7s9Rk7Y6AmifkS/uTuMG3SunNZ:rogQ9yjXps9R+J3UrYuMQN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2556 1CC4.tmp 2884 1D12.tmp 2728 1D60.tmp 2848 1DAE.tmp 2692 1DFC.tmp 2704 1E3A.tmp 2672 1E79.tmp 2812 1EB7.tmp 2760 1F15.tmp 2656 1F72.tmp 3020 1FC0.tmp 1032 200E.tmp 356 206C.tmp 2644 20CA.tmp 2880 2108.tmp 1984 2146.tmp 328 21A4.tmp 1964 2202.tmp 1304 2240.tmp 2504 227E.tmp 864 22DC.tmp 1640 232A.tmp 1548 2388.tmp 2308 23E5.tmp 2680 2433.tmp 2092 2491.tmp 2900 24DF.tmp 2448 252D.tmp 1312 256B.tmp 560 25E8.tmp 268 2626.tmp 996 2674.tmp 600 26D2.tmp 1492 2730.tmp 848 27AC.tmp 1784 280A.tmp 2368 2858.tmp 1100 2896.tmp 2400 28E4.tmp 1336 2932.tmp 1576 2971.tmp 1364 29BF.tmp 1672 2A0D.tmp 2124 2A5B.tmp 972 2A99.tmp 588 2AE7.tmp 1060 2B26.tmp 2108 2B64.tmp 852 2BA2.tmp 1384 2BF0.tmp 2276 2C2F.tmp 1524 2C7D.tmp 1040 2CBB.tmp 2116 2D09.tmp 1316 2D48.tmp 2068 2D86.tmp 2932 2DC4.tmp 2772 2E03.tmp 2468 2E41.tmp 2824 2E8F.tmp 2836 2EDD.tmp 2952 2F2B.tmp 1328 2F6A.tmp 2600 2FC7.tmp -
Loads dropped DLL 64 IoCs
pid Process 2032 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 2556 1CC4.tmp 2884 1D12.tmp 2728 1D60.tmp 2848 1DAE.tmp 2692 1DFC.tmp 2704 1E3A.tmp 2672 1E79.tmp 2812 1EB7.tmp 2760 1F15.tmp 2656 1F72.tmp 3020 1FC0.tmp 1032 200E.tmp 356 206C.tmp 2644 20CA.tmp 2880 2108.tmp 1984 2146.tmp 328 21A4.tmp 1964 2202.tmp 1304 2240.tmp 2504 227E.tmp 864 22DC.tmp 1640 232A.tmp 1548 2388.tmp 2308 23E5.tmp 2680 2433.tmp 2092 2491.tmp 2900 24DF.tmp 2448 252D.tmp 1312 256B.tmp 560 25E8.tmp 268 2626.tmp 996 2674.tmp 600 26D2.tmp 1492 2730.tmp 848 27AC.tmp 1784 280A.tmp 2368 2858.tmp 1100 2896.tmp 2400 28E4.tmp 1336 2932.tmp 1576 2971.tmp 1364 29BF.tmp 1672 2A0D.tmp 2124 2A5B.tmp 972 2A99.tmp 588 2AE7.tmp 1060 2B26.tmp 2108 2B64.tmp 852 2BA2.tmp 1384 2BF0.tmp 2276 2C2F.tmp 1524 2C7D.tmp 1040 2CBB.tmp 2116 2D09.tmp 1316 2D48.tmp 2068 2D86.tmp 2932 2DC4.tmp 2772 2E03.tmp 2468 2E41.tmp 2824 2E8F.tmp 2836 2EDD.tmp 2952 2F2B.tmp 1328 2F6A.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2032 wrote to memory of 2556 2032 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 28 PID 2032 wrote to memory of 2556 2032 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 28 PID 2032 wrote to memory of 2556 2032 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 28 PID 2032 wrote to memory of 2556 2032 2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe 28 PID 2556 wrote to memory of 2884 2556 1CC4.tmp 29 PID 2556 wrote to memory of 2884 2556 1CC4.tmp 29 PID 2556 wrote to memory of 2884 2556 1CC4.tmp 29 PID 2556 wrote to memory of 2884 2556 1CC4.tmp 29 PID 2884 wrote to memory of 2728 2884 1D12.tmp 30 PID 2884 wrote to memory of 2728 2884 1D12.tmp 30 PID 2884 wrote to memory of 2728 2884 1D12.tmp 30 PID 2884 wrote to memory of 2728 2884 1D12.tmp 30 PID 2728 wrote to memory of 2848 2728 1D60.tmp 31 PID 2728 wrote to memory of 2848 2728 1D60.tmp 31 PID 2728 wrote to memory of 2848 2728 1D60.tmp 31 PID 2728 wrote to memory of 2848 2728 1D60.tmp 31 PID 2848 wrote to memory of 2692 2848 1DAE.tmp 32 PID 2848 wrote to memory of 2692 2848 1DAE.tmp 32 PID 2848 wrote to memory of 2692 2848 1DAE.tmp 32 PID 2848 wrote to memory of 2692 2848 1DAE.tmp 32 PID 2692 wrote to memory of 2704 2692 1DFC.tmp 54 PID 2692 wrote to memory of 2704 2692 1DFC.tmp 54 PID 2692 wrote to memory of 2704 2692 1DFC.tmp 54 PID 2692 wrote to memory of 2704 2692 1DFC.tmp 54 PID 2704 wrote to memory of 2672 2704 1E3A.tmp 33 PID 2704 wrote to memory of 2672 2704 1E3A.tmp 33 PID 2704 wrote to memory of 2672 2704 1E3A.tmp 33 PID 2704 wrote to memory of 2672 2704 1E3A.tmp 33 PID 2672 wrote to memory of 2812 2672 1E79.tmp 34 PID 2672 wrote to memory of 2812 2672 1E79.tmp 34 PID 2672 wrote to memory of 2812 2672 1E79.tmp 34 PID 2672 wrote to memory of 2812 2672 1E79.tmp 34 PID 2812 wrote to memory of 2760 2812 1EB7.tmp 35 PID 2812 wrote to memory of 2760 2812 1EB7.tmp 35 PID 2812 wrote to memory of 2760 2812 1EB7.tmp 35 PID 2812 wrote to memory of 2760 2812 1EB7.tmp 35 PID 2760 wrote to memory of 2656 2760 1F15.tmp 36 PID 2760 wrote to memory of 2656 2760 1F15.tmp 36 PID 2760 wrote to memory of 2656 2760 1F15.tmp 36 PID 2760 wrote to memory of 2656 2760 1F15.tmp 36 PID 2656 wrote to memory of 3020 2656 1F72.tmp 53 PID 2656 wrote to memory of 3020 2656 1F72.tmp 53 PID 2656 wrote to memory of 3020 2656 1F72.tmp 53 PID 2656 wrote to memory of 3020 2656 1F72.tmp 53 PID 3020 wrote to memory of 1032 3020 1FC0.tmp 52 PID 3020 wrote to memory of 1032 3020 1FC0.tmp 52 PID 3020 wrote to memory of 1032 3020 1FC0.tmp 52 PID 3020 wrote to memory of 1032 3020 1FC0.tmp 52 PID 1032 wrote to memory of 356 1032 200E.tmp 51 PID 1032 wrote to memory of 356 1032 200E.tmp 51 PID 1032 wrote to memory of 356 1032 200E.tmp 51 PID 1032 wrote to memory of 356 1032 200E.tmp 51 PID 356 wrote to memory of 2644 356 206C.tmp 50 PID 356 wrote to memory of 2644 356 206C.tmp 50 PID 356 wrote to memory of 2644 356 206C.tmp 50 PID 356 wrote to memory of 2644 356 206C.tmp 50 PID 2644 wrote to memory of 2880 2644 20CA.tmp 49 PID 2644 wrote to memory of 2880 2644 20CA.tmp 49 PID 2644 wrote to memory of 2880 2644 20CA.tmp 49 PID 2644 wrote to memory of 2880 2644 20CA.tmp 49 PID 2880 wrote to memory of 1984 2880 2108.tmp 48 PID 2880 wrote to memory of 1984 2880 2108.tmp 48 PID 2880 wrote to memory of 1984 2880 2108.tmp 48 PID 2880 wrote to memory of 1984 2880 2108.tmp 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_afc815477106f6d600d1a00af5af7917_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"C:\Users\Admin\AppData\Local\Temp\1CC4.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Users\Admin\AppData\Local\Temp\1D60.tmp"C:\Users\Admin\AppData\Local\Temp\1D60.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"C:\Users\Admin\AppData\Local\Temp\1DFC.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"C:\Users\Admin\AppData\Local\Temp\1E3A.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2704
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1E79.tmp"C:\Users\Admin\AppData\Local\Temp\1E79.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\1F15.tmp"C:\Users\Admin\AppData\Local\Temp\1F15.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\23E5.tmp"C:\Users\Admin\AppData\Local\Temp\23E5.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\2433.tmp"C:\Users\Admin\AppData\Local\Temp\2433.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680 -
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\24DF.tmp"C:\Users\Admin\AppData\Local\Temp\24DF.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\252D.tmp"C:\Users\Admin\AppData\Local\Temp\252D.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\256B.tmp"C:\Users\Admin\AppData\Local\Temp\256B.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1312 -
C:\Users\Admin\AppData\Local\Temp\25E8.tmp"C:\Users\Admin\AppData\Local\Temp\25E8.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:560 -
C:\Users\Admin\AppData\Local\Temp\2626.tmp"C:\Users\Admin\AppData\Local\Temp\2626.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:268 -
C:\Users\Admin\AppData\Local\Temp\2674.tmp"C:\Users\Admin\AppData\Local\Temp\2674.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:996 -
C:\Users\Admin\AppData\Local\Temp\26D2.tmp"C:\Users\Admin\AppData\Local\Temp\26D2.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:600 -
C:\Users\Admin\AppData\Local\Temp\2730.tmp"C:\Users\Admin\AppData\Local\Temp\2730.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\27AC.tmp"C:\Users\Admin\AppData\Local\Temp\27AC.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:848 -
C:\Users\Admin\AppData\Local\Temp\280A.tmp"C:\Users\Admin\AppData\Local\Temp\280A.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\2858.tmp"C:\Users\Admin\AppData\Local\Temp\2858.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\2896.tmp"C:\Users\Admin\AppData\Local\Temp\2896.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1100 -
C:\Users\Admin\AppData\Local\Temp\28E4.tmp"C:\Users\Admin\AppData\Local\Temp\28E4.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1576 -
C:\Users\Admin\AppData\Local\Temp\29BF.tmp"C:\Users\Admin\AppData\Local\Temp\29BF.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"C:\Users\Admin\AppData\Local\Temp\2A0D.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"C:\Users\Admin\AppData\Local\Temp\2A5B.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2124 -
C:\Users\Admin\AppData\Local\Temp\2A99.tmp"C:\Users\Admin\AppData\Local\Temp\2A99.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:972 -
C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"C:\Users\Admin\AppData\Local\Temp\2AE7.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:588 -
C:\Users\Admin\AppData\Local\Temp\2B26.tmp"C:\Users\Admin\AppData\Local\Temp\2B26.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1060 -
C:\Users\Admin\AppData\Local\Temp\2B64.tmp"C:\Users\Admin\AppData\Local\Temp\2B64.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2108 -
C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"C:\Users\Admin\AppData\Local\Temp\2BA2.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:852 -
C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"C:\Users\Admin\AppData\Local\Temp\2BF0.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"C:\Users\Admin\AppData\Local\Temp\2C2F.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"C:\Users\Admin\AppData\Local\Temp\2C7D.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"C:\Users\Admin\AppData\Local\Temp\2CBB.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\2D09.tmp"C:\Users\Admin\AppData\Local\Temp\2D09.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\2D48.tmp"C:\Users\Admin\AppData\Local\Temp\2D48.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1316 -
C:\Users\Admin\AppData\Local\Temp\2D86.tmp"C:\Users\Admin\AppData\Local\Temp\2D86.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"C:\Users\Admin\AppData\Local\Temp\2DC4.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\2E03.tmp"C:\Users\Admin\AppData\Local\Temp\2E03.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\2E41.tmp"C:\Users\Admin\AppData\Local\Temp\2E41.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"C:\Users\Admin\AppData\Local\Temp\2EDD.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2836 -
C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"C:\Users\Admin\AppData\Local\Temp\2F2B.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2952 -
C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"C:\Users\Admin\AppData\Local\Temp\2F6A.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"C:\Users\Admin\AppData\Local\Temp\2FC7.tmp"42⤵
- Executes dropped EXE
PID:2600 -
C:\Users\Admin\AppData\Local\Temp\3006.tmp"C:\Users\Admin\AppData\Local\Temp\3006.tmp"43⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"44⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"45⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\30E0.tmp"C:\Users\Admin\AppData\Local\Temp\30E0.tmp"46⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\311E.tmp"C:\Users\Admin\AppData\Local\Temp\311E.tmp"47⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\315D.tmp"C:\Users\Admin\AppData\Local\Temp\315D.tmp"48⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\319B.tmp"C:\Users\Admin\AppData\Local\Temp\319B.tmp"49⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\31E9.tmp"C:\Users\Admin\AppData\Local\Temp\31E9.tmp"50⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\3228.tmp"C:\Users\Admin\AppData\Local\Temp\3228.tmp"51⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\3276.tmp"C:\Users\Admin\AppData\Local\Temp\3276.tmp"52⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\32B4.tmp"C:\Users\Admin\AppData\Local\Temp\32B4.tmp"53⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"54⤵PID:1596
-
C:\Users\Admin\AppData\Local\Temp\3340.tmp"C:\Users\Admin\AppData\Local\Temp\3340.tmp"55⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"56⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"57⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"58⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"59⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"60⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"61⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\3514.tmp"C:\Users\Admin\AppData\Local\Temp\3514.tmp"62⤵PID:3028
-
C:\Users\Admin\AppData\Local\Temp\3553.tmp"C:\Users\Admin\AppData\Local\Temp\3553.tmp"63⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"64⤵PID:2732
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"65⤵PID:2660
-
C:\Users\Admin\AppData\Local\Temp\362D.tmp"C:\Users\Admin\AppData\Local\Temp\362D.tmp"66⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\366C.tmp"C:\Users\Admin\AppData\Local\Temp\366C.tmp"67⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\36AA.tmp"C:\Users\Admin\AppData\Local\Temp\36AA.tmp"68⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\36F8.tmp"C:\Users\Admin\AppData\Local\Temp\36F8.tmp"69⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\3746.tmp"C:\Users\Admin\AppData\Local\Temp\3746.tmp"70⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\3784.tmp"C:\Users\Admin\AppData\Local\Temp\3784.tmp"71⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\37C3.tmp"C:\Users\Admin\AppData\Local\Temp\37C3.tmp"72⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\3811.tmp"C:\Users\Admin\AppData\Local\Temp\3811.tmp"73⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\385F.tmp"C:\Users\Admin\AppData\Local\Temp\385F.tmp"74⤵PID:1312
-
C:\Users\Admin\AppData\Local\Temp\389D.tmp"C:\Users\Admin\AppData\Local\Temp\389D.tmp"75⤵PID:712
-
C:\Users\Admin\AppData\Local\Temp\38EB.tmp"C:\Users\Admin\AppData\Local\Temp\38EB.tmp"76⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\392A.tmp"C:\Users\Admin\AppData\Local\Temp\392A.tmp"77⤵PID:1500
-
C:\Users\Admin\AppData\Local\Temp\3987.tmp"C:\Users\Admin\AppData\Local\Temp\3987.tmp"78⤵PID:600
-
C:\Users\Admin\AppData\Local\Temp\39C6.tmp"C:\Users\Admin\AppData\Local\Temp\39C6.tmp"79⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\3A14.tmp"C:\Users\Admin\AppData\Local\Temp\3A14.tmp"80⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\3A62.tmp"C:\Users\Admin\AppData\Local\Temp\3A62.tmp"81⤵PID:1136
-
C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"C:\Users\Admin\AppData\Local\Temp\3AB0.tmp"82⤵PID:1276
-
C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"C:\Users\Admin\AppData\Local\Temp\3AFE.tmp"83⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"C:\Users\Admin\AppData\Local\Temp\3B3C.tmp"84⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"C:\Users\Admin\AppData\Local\Temp\3B7A.tmp"85⤵PID:2520
-
C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"C:\Users\Admin\AppData\Local\Temp\3BC8.tmp"86⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\3C07.tmp"C:\Users\Admin\AppData\Local\Temp\3C07.tmp"87⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\3C45.tmp"C:\Users\Admin\AppData\Local\Temp\3C45.tmp"88⤵PID:1672
-
C:\Users\Admin\AppData\Local\Temp\3C84.tmp"C:\Users\Admin\AppData\Local\Temp\3C84.tmp"89⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"C:\Users\Admin\AppData\Local\Temp\3CC2.tmp"90⤵PID:1212
-
C:\Users\Admin\AppData\Local\Temp\3D00.tmp"C:\Users\Admin\AppData\Local\Temp\3D00.tmp"91⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"C:\Users\Admin\AppData\Local\Temp\3D4E.tmp"92⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"C:\Users\Admin\AppData\Local\Temp\3D8D.tmp"93⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"C:\Users\Admin\AppData\Local\Temp\3DCB.tmp"94⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"C:\Users\Admin\AppData\Local\Temp\3E0A.tmp"95⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\3E48.tmp"C:\Users\Admin\AppData\Local\Temp\3E48.tmp"96⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\3E86.tmp"C:\Users\Admin\AppData\Local\Temp\3E86.tmp"97⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"C:\Users\Admin\AppData\Local\Temp\3EC5.tmp"98⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\3F13.tmp"C:\Users\Admin\AppData\Local\Temp\3F13.tmp"99⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\3F61.tmp"C:\Users\Admin\AppData\Local\Temp\3F61.tmp"100⤵PID:1272
-
C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"C:\Users\Admin\AppData\Local\Temp\3F9F.tmp"101⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\3FED.tmp"C:\Users\Admin\AppData\Local\Temp\3FED.tmp"102⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\402C.tmp"C:\Users\Admin\AppData\Local\Temp\402C.tmp"103⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\407A.tmp"C:\Users\Admin\AppData\Local\Temp\407A.tmp"104⤵PID:2696
-
C:\Users\Admin\AppData\Local\Temp\40C8.tmp"C:\Users\Admin\AppData\Local\Temp\40C8.tmp"105⤵PID:2840
-
C:\Users\Admin\AppData\Local\Temp\4116.tmp"C:\Users\Admin\AppData\Local\Temp\4116.tmp"106⤵PID:2724
-
C:\Users\Admin\AppData\Local\Temp\4154.tmp"C:\Users\Admin\AppData\Local\Temp\4154.tmp"107⤵PID:2596
-
C:\Users\Admin\AppData\Local\Temp\41A2.tmp"C:\Users\Admin\AppData\Local\Temp\41A2.tmp"108⤵PID:2484
-
C:\Users\Admin\AppData\Local\Temp\41E0.tmp"C:\Users\Admin\AppData\Local\Temp\41E0.tmp"109⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\421F.tmp"C:\Users\Admin\AppData\Local\Temp\421F.tmp"110⤵PID:2600
-
C:\Users\Admin\AppData\Local\Temp\425D.tmp"C:\Users\Admin\AppData\Local\Temp\425D.tmp"111⤵PID:2804
-
C:\Users\Admin\AppData\Local\Temp\42AB.tmp"C:\Users\Admin\AppData\Local\Temp\42AB.tmp"112⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\42EA.tmp"C:\Users\Admin\AppData\Local\Temp\42EA.tmp"113⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\4328.tmp"C:\Users\Admin\AppData\Local\Temp\4328.tmp"114⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\4386.tmp"C:\Users\Admin\AppData\Local\Temp\4386.tmp"115⤵PID:2708
-
C:\Users\Admin\AppData\Local\Temp\43E3.tmp"C:\Users\Admin\AppData\Local\Temp\43E3.tmp"116⤵PID:1924
-
C:\Users\Admin\AppData\Local\Temp\4422.tmp"C:\Users\Admin\AppData\Local\Temp\4422.tmp"117⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\4470.tmp"C:\Users\Admin\AppData\Local\Temp\4470.tmp"118⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\44AE.tmp"C:\Users\Admin\AppData\Local\Temp\44AE.tmp"119⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\44FC.tmp"C:\Users\Admin\AppData\Local\Temp\44FC.tmp"120⤵PID:2316
-
C:\Users\Admin\AppData\Local\Temp\453A.tmp"C:\Users\Admin\AppData\Local\Temp\453A.tmp"121⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\4579.tmp"C:\Users\Admin\AppData\Local\Temp\4579.tmp"122⤵PID:1596
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-