Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/02/2024, 04:48
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
Resource
win7-20240221-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
Resource
win10v2004-20240226-en
2 signatures
150 seconds
General
-
Target
2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe
-
Size
487KB
-
MD5
f7dce14e4ed0f3d99fd45a1e8ebe3734
-
SHA1
1235c41910d97e05d0c835ceb502ef6d8da096fa
-
SHA256
81c55feb0363fae7233dff7877e99b447daba57eb7e14dd284e8746da1eb1a71
-
SHA512
1a94464b2c854b1bedec5c10af2ecfd134fd95d2e4ede38b5b67f5054ddc4c6f27bbb8452cdde9140675556f4a062275ac88c288295eb03a9ba39f8f3421651f
-
SSDEEP
12288:yU5rCOTeiNQ8dgBV8Jn2Pdjk6ZSeVbqnbZ:yUQOJNLdNJn2PqYSWbqnb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2668 E91.tmp 2960 EFE.tmp 2620 F5C.tmp 2616 F9A.tmp 2608 FE8.tmp 2912 1027.tmp 2392 1075.tmp 2536 10B3.tmp 2376 10F2.tmp 2444 1130.tmp 3044 117E.tmp 1600 11CC.tmp 1228 121A.tmp 2340 1268.tmp 1936 12B6.tmp 1748 1304.tmp 1932 1352.tmp 1044 13A0.tmp 1948 13EE.tmp 1648 144C.tmp 1692 148A.tmp 284 14C8.tmp 2840 1516.tmp 2708 1564.tmp 2676 15A3.tmp 1268 15E1.tmp 1920 1620.tmp 2464 165E.tmp 324 169C.tmp 336 16DB.tmp 1116 1729.tmp 576 1767.tmp 2344 17A6.tmp 1712 17E4.tmp 796 1822.tmp 620 1861.tmp 2904 189F.tmp 704 18DE.tmp 2968 191C.tmp 2312 195A.tmp 1476 1999.tmp 2116 19D7.tmp 1564 1A35.tmp 1860 1A83.tmp 1880 1B00.tmp 924 1B4E.tmp 2900 1BDA.tmp 2864 1C18.tmp 2148 1C57.tmp 2012 1C95.tmp 1480 1CD4.tmp 2188 1D12.tmp 1444 1D50.tmp 2112 1D9E.tmp 2224 1DDD.tmp 1512 1E2B.tmp 1656 1E69.tmp 2556 1EA8.tmp 2724 1EE6.tmp 2640 1F34.tmp 2516 1F72.tmp 2620 1FB1.tmp 2512 1FEF.tmp 2604 202E.tmp -
Loads dropped DLL 64 IoCs
pid Process 2164 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 2668 E91.tmp 2960 EFE.tmp 2620 F5C.tmp 2616 F9A.tmp 2608 FE8.tmp 2912 1027.tmp 2392 1075.tmp 2536 10B3.tmp 2376 10F2.tmp 2444 1130.tmp 3044 117E.tmp 1600 11CC.tmp 1228 121A.tmp 2340 1268.tmp 1936 12B6.tmp 1748 1304.tmp 1932 1352.tmp 1044 13A0.tmp 1948 13EE.tmp 1648 144C.tmp 1692 148A.tmp 284 14C8.tmp 2840 1516.tmp 2708 1564.tmp 2676 15A3.tmp 1268 15E1.tmp 1920 1620.tmp 2464 165E.tmp 324 169C.tmp 336 16DB.tmp 1116 1729.tmp 576 1767.tmp 2344 17A6.tmp 1712 17E4.tmp 796 1822.tmp 620 1861.tmp 2904 189F.tmp 704 18DE.tmp 2968 191C.tmp 2312 195A.tmp 1476 1999.tmp 2116 19D7.tmp 1564 1A35.tmp 1860 1A83.tmp 1880 1B00.tmp 924 1B4E.tmp 2900 1BDA.tmp 2864 1C18.tmp 2148 1C57.tmp 2012 1C95.tmp 1480 1CD4.tmp 2188 1D12.tmp 1444 1D50.tmp 2112 1D9E.tmp 2224 1DDD.tmp 1512 1E2B.tmp 1656 1E69.tmp 2556 1EA8.tmp 2724 1EE6.tmp 2640 1F34.tmp 2516 1F72.tmp 2620 1FB1.tmp 2512 1FEF.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2164 wrote to memory of 2668 2164 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 28 PID 2164 wrote to memory of 2668 2164 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 28 PID 2164 wrote to memory of 2668 2164 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 28 PID 2164 wrote to memory of 2668 2164 2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe 28 PID 2668 wrote to memory of 2960 2668 E91.tmp 29 PID 2668 wrote to memory of 2960 2668 E91.tmp 29 PID 2668 wrote to memory of 2960 2668 E91.tmp 29 PID 2668 wrote to memory of 2960 2668 E91.tmp 29 PID 2960 wrote to memory of 2620 2960 EFE.tmp 30 PID 2960 wrote to memory of 2620 2960 EFE.tmp 30 PID 2960 wrote to memory of 2620 2960 EFE.tmp 30 PID 2960 wrote to memory of 2620 2960 EFE.tmp 30 PID 2620 wrote to memory of 2616 2620 F5C.tmp 31 PID 2620 wrote to memory of 2616 2620 F5C.tmp 31 PID 2620 wrote to memory of 2616 2620 F5C.tmp 31 PID 2620 wrote to memory of 2616 2620 F5C.tmp 31 PID 2616 wrote to memory of 2608 2616 F9A.tmp 32 PID 2616 wrote to memory of 2608 2616 F9A.tmp 32 PID 2616 wrote to memory of 2608 2616 F9A.tmp 32 PID 2616 wrote to memory of 2608 2616 F9A.tmp 32 PID 2608 wrote to memory of 2912 2608 FE8.tmp 33 PID 2608 wrote to memory of 2912 2608 FE8.tmp 33 PID 2608 wrote to memory of 2912 2608 FE8.tmp 33 PID 2608 wrote to memory of 2912 2608 FE8.tmp 33 PID 2912 wrote to memory of 2392 2912 1027.tmp 67 PID 2912 wrote to memory of 2392 2912 1027.tmp 67 PID 2912 wrote to memory of 2392 2912 1027.tmp 67 PID 2912 wrote to memory of 2392 2912 1027.tmp 67 PID 2392 wrote to memory of 2536 2392 1075.tmp 66 PID 2392 wrote to memory of 2536 2392 1075.tmp 66 PID 2392 wrote to memory of 2536 2392 1075.tmp 66 PID 2392 wrote to memory of 2536 2392 1075.tmp 66 PID 2536 wrote to memory of 2376 2536 10B3.tmp 65 PID 2536 wrote to memory of 2376 2536 10B3.tmp 65 PID 2536 wrote to memory of 2376 2536 10B3.tmp 65 PID 2536 wrote to memory of 2376 2536 10B3.tmp 65 PID 2376 wrote to memory of 2444 2376 10F2.tmp 34 PID 2376 wrote to memory of 2444 2376 10F2.tmp 34 PID 2376 wrote to memory of 2444 2376 10F2.tmp 34 PID 2376 wrote to memory of 2444 2376 10F2.tmp 34 PID 2444 wrote to memory of 3044 2444 1130.tmp 35 PID 2444 wrote to memory of 3044 2444 1130.tmp 35 PID 2444 wrote to memory of 3044 2444 1130.tmp 35 PID 2444 wrote to memory of 3044 2444 1130.tmp 35 PID 3044 wrote to memory of 1600 3044 117E.tmp 64 PID 3044 wrote to memory of 1600 3044 117E.tmp 64 PID 3044 wrote to memory of 1600 3044 117E.tmp 64 PID 3044 wrote to memory of 1600 3044 117E.tmp 64 PID 1600 wrote to memory of 1228 1600 11CC.tmp 37 PID 1600 wrote to memory of 1228 1600 11CC.tmp 37 PID 1600 wrote to memory of 1228 1600 11CC.tmp 37 PID 1600 wrote to memory of 1228 1600 11CC.tmp 37 PID 1228 wrote to memory of 2340 1228 121A.tmp 36 PID 1228 wrote to memory of 2340 1228 121A.tmp 36 PID 1228 wrote to memory of 2340 1228 121A.tmp 36 PID 1228 wrote to memory of 2340 1228 121A.tmp 36 PID 2340 wrote to memory of 1936 2340 1268.tmp 62 PID 2340 wrote to memory of 1936 2340 1268.tmp 62 PID 2340 wrote to memory of 1936 2340 1268.tmp 62 PID 2340 wrote to memory of 1936 2340 1268.tmp 62 PID 1936 wrote to memory of 1748 1936 12B6.tmp 61 PID 1936 wrote to memory of 1748 1936 12B6.tmp 61 PID 1936 wrote to memory of 1748 1936 12B6.tmp 61 PID 1936 wrote to memory of 1748 1936 12B6.tmp 61
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-29_f7dce14e4ed0f3d99fd45a1e8ebe3734_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Users\Admin\AppData\Local\Temp\EFE.tmp"C:\Users\Admin\AppData\Local\Temp\EFE.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\F5C.tmp"C:\Users\Admin\AppData\Local\Temp\F5C.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\F9A.tmp"C:\Users\Admin\AppData\Local\Temp\F9A.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\FE8.tmp"C:\Users\Admin\AppData\Local\Temp\FE8.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\1027.tmp"C:\Users\Admin\AppData\Local\Temp\1027.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\1075.tmp"C:\Users\Admin\AppData\Local\Temp\1075.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2392
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1130.tmp"C:\Users\Admin\AppData\Local\Temp\1130.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Users\Admin\AppData\Local\Temp\117E.tmp"C:\Users\Admin\AppData\Local\Temp\117E.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\11CC.tmp"C:\Users\Admin\AppData\Local\Temp\11CC.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1600
-
-
-
C:\Users\Admin\AppData\Local\Temp\1268.tmp"C:\Users\Admin\AppData\Local\Temp\1268.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\12B6.tmp"C:\Users\Admin\AppData\Local\Temp\12B6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
-
-
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228
-
C:\Users\Admin\AppData\Local\Temp\14C8.tmp"C:\Users\Admin\AppData\Local\Temp\14C8.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:284 -
C:\Users\Admin\AppData\Local\Temp\1516.tmp"C:\Users\Admin\AppData\Local\Temp\1516.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2708
-
-
-
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920
-
-
-
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:324 -
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:336 -
C:\Users\Admin\AppData\Local\Temp\1729.tmp"C:\Users\Admin\AppData\Local\Temp\1729.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\1767.tmp"C:\Users\Admin\AppData\Local\Temp\1767.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:576 -
C:\Users\Admin\AppData\Local\Temp\17A6.tmp"C:\Users\Admin\AppData\Local\Temp\17A6.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\17E4.tmp"C:\Users\Admin\AppData\Local\Temp\17E4.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712 -
C:\Users\Admin\AppData\Local\Temp\1822.tmp"C:\Users\Admin\AppData\Local\Temp\1822.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
PID:796 -
C:\Users\Admin\AppData\Local\Temp\1861.tmp"C:\Users\Admin\AppData\Local\Temp\1861.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
PID:620 -
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
PID:704 -
C:\Users\Admin\AppData\Local\Temp\191C.tmp"C:\Users\Admin\AppData\Local\Temp\191C.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\195A.tmp"C:\Users\Admin\AppData\Local\Temp\195A.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\1999.tmp"C:\Users\Admin\AppData\Local\Temp\1999.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\19D7.tmp"C:\Users\Admin\AppData\Local\Temp\19D7.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\1A83.tmp"C:\Users\Admin\AppData\Local\Temp\1A83.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\1B00.tmp"C:\Users\Admin\AppData\Local\Temp\1B00.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"C:\Users\Admin\AppData\Local\Temp\1B4E.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:924 -
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\1C18.tmp"C:\Users\Admin\AppData\Local\Temp\1C18.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\1C57.tmp"C:\Users\Admin\AppData\Local\Temp\1C57.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\1C95.tmp"C:\Users\Admin\AppData\Local\Temp\1C95.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"C:\Users\Admin\AppData\Local\Temp\1CD4.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\1D12.tmp"C:\Users\Admin\AppData\Local\Temp\1D12.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\1D50.tmp"C:\Users\Admin\AppData\Local\Temp\1D50.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1444 -
C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"C:\Users\Admin\AppData\Local\Temp\1D9E.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"C:\Users\Admin\AppData\Local\Temp\1DDD.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224 -
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"C:\Users\Admin\AppData\Local\Temp\1EA8.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"C:\Users\Admin\AppData\Local\Temp\1EE6.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\1F34.tmp"C:\Users\Admin\AppData\Local\Temp\1F34.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\1F72.tmp"C:\Users\Admin\AppData\Local\Temp\1F72.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2516 -
C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"C:\Users\Admin\AppData\Local\Temp\1FB1.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"C:\Users\Admin\AppData\Local\Temp\1FEF.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\202E.tmp"C:\Users\Admin\AppData\Local\Temp\202E.tmp"37⤵
- Executes dropped EXE
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\207C.tmp"C:\Users\Admin\AppData\Local\Temp\207C.tmp"38⤵PID:2492
-
C:\Users\Admin\AppData\Local\Temp\20BA.tmp"C:\Users\Admin\AppData\Local\Temp\20BA.tmp"39⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\20F8.tmp"C:\Users\Admin\AppData\Local\Temp\20F8.tmp"40⤵PID:2420
-
C:\Users\Admin\AppData\Local\Temp\2146.tmp"C:\Users\Admin\AppData\Local\Temp\2146.tmp"41⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"42⤵PID:2584
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"43⤵PID:2648
-
C:\Users\Admin\AppData\Local\Temp\2240.tmp"C:\Users\Admin\AppData\Local\Temp\2240.tmp"44⤵PID:2820
-
C:\Users\Admin\AppData\Local\Temp\228E.tmp"C:\Users\Admin\AppData\Local\Temp\228E.tmp"45⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\22CC.tmp"C:\Users\Admin\AppData\Local\Temp\22CC.tmp"46⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\230B.tmp"C:\Users\Admin\AppData\Local\Temp\230B.tmp"47⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\2349.tmp"C:\Users\Admin\AppData\Local\Temp\2349.tmp"48⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\2388.tmp"C:\Users\Admin\AppData\Local\Temp\2388.tmp"49⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"50⤵PID:1964
-
C:\Users\Admin\AppData\Local\Temp\2414.tmp"C:\Users\Admin\AppData\Local\Temp\2414.tmp"51⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\2452.tmp"C:\Users\Admin\AppData\Local\Temp\2452.tmp"52⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\2491.tmp"C:\Users\Admin\AppData\Local\Temp\2491.tmp"53⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\24CF.tmp"C:\Users\Admin\AppData\Local\Temp\24CF.tmp"54⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\250E.tmp"C:\Users\Admin\AppData\Local\Temp\250E.tmp"55⤵PID:1844
-
C:\Users\Admin\AppData\Local\Temp\254C.tmp"C:\Users\Admin\AppData\Local\Temp\254C.tmp"56⤵PID:1584
-
C:\Users\Admin\AppData\Local\Temp\258A.tmp"C:\Users\Admin\AppData\Local\Temp\258A.tmp"57⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\25C9.tmp"C:\Users\Admin\AppData\Local\Temp\25C9.tmp"58⤵PID:1988
-
C:\Users\Admin\AppData\Local\Temp\2607.tmp"C:\Users\Admin\AppData\Local\Temp\2607.tmp"59⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\2646.tmp"C:\Users\Admin\AppData\Local\Temp\2646.tmp"60⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\2684.tmp"C:\Users\Admin\AppData\Local\Temp\2684.tmp"61⤵PID:1696
-
C:\Users\Admin\AppData\Local\Temp\26C2.tmp"C:\Users\Admin\AppData\Local\Temp\26C2.tmp"62⤵PID:876
-
C:\Users\Admin\AppData\Local\Temp\2701.tmp"C:\Users\Admin\AppData\Local\Temp\2701.tmp"63⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\273F.tmp"C:\Users\Admin\AppData\Local\Temp\273F.tmp"64⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\277E.tmp"C:\Users\Admin\AppData\Local\Temp\277E.tmp"65⤵PID:1256
-
C:\Users\Admin\AppData\Local\Temp\27BC.tmp"C:\Users\Admin\AppData\Local\Temp\27BC.tmp"66⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\27FA.tmp"C:\Users\Admin\AppData\Local\Temp\27FA.tmp"67⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\2839.tmp"C:\Users\Admin\AppData\Local\Temp\2839.tmp"68⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\2877.tmp"C:\Users\Admin\AppData\Local\Temp\2877.tmp"69⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\28B6.tmp"C:\Users\Admin\AppData\Local\Temp\28B6.tmp"70⤵PID:536
-
C:\Users\Admin\AppData\Local\Temp\28F4.tmp"C:\Users\Admin\AppData\Local\Temp\28F4.tmp"71⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\2932.tmp"C:\Users\Admin\AppData\Local\Temp\2932.tmp"72⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\2971.tmp"C:\Users\Admin\AppData\Local\Temp\2971.tmp"73⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\29AF.tmp"C:\Users\Admin\AppData\Local\Temp\29AF.tmp"74⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\29FD.tmp"C:\Users\Admin\AppData\Local\Temp\29FD.tmp"75⤵PID:648
-
C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"C:\Users\Admin\AppData\Local\Temp\2A3C.tmp"76⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"C:\Users\Admin\AppData\Local\Temp\2A7A.tmp"77⤵PID:620
-
C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"C:\Users\Admin\AppData\Local\Temp\2AB8.tmp"78⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\2B06.tmp"C:\Users\Admin\AppData\Local\Temp\2B06.tmp"79⤵PID:704
-
C:\Users\Admin\AppData\Local\Temp\2B54.tmp"C:\Users\Admin\AppData\Local\Temp\2B54.tmp"80⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\2B93.tmp"C:\Users\Admin\AppData\Local\Temp\2B93.tmp"81⤵PID:1704
-
C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"C:\Users\Admin\AppData\Local\Temp\2BD1.tmp"82⤵PID:1476
-
C:\Users\Admin\AppData\Local\Temp\2C10.tmp"C:\Users\Admin\AppData\Local\Temp\2C10.tmp"83⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"C:\Users\Admin\AppData\Local\Temp\2C4E.tmp"84⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"C:\Users\Admin\AppData\Local\Temp\2C8C.tmp"85⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"C:\Users\Admin\AppData\Local\Temp\2CDA.tmp"86⤵PID:1064
-
C:\Users\Admin\AppData\Local\Temp\2D19.tmp"C:\Users\Admin\AppData\Local\Temp\2D19.tmp"87⤵PID:924
-
C:\Users\Admin\AppData\Local\Temp\2D57.tmp"C:\Users\Admin\AppData\Local\Temp\2D57.tmp"88⤵PID:2776
-
C:\Users\Admin\AppData\Local\Temp\2D96.tmp"C:\Users\Admin\AppData\Local\Temp\2D96.tmp"89⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"C:\Users\Admin\AppData\Local\Temp\2DD4.tmp"90⤵PID:2148
-
C:\Users\Admin\AppData\Local\Temp\2E12.tmp"C:\Users\Admin\AppData\Local\Temp\2E12.tmp"91⤵PID:2012
-
C:\Users\Admin\AppData\Local\Temp\2E51.tmp"C:\Users\Admin\AppData\Local\Temp\2E51.tmp"92⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"C:\Users\Admin\AppData\Local\Temp\2E8F.tmp"93⤵PID:1164
-
C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"C:\Users\Admin\AppData\Local\Temp\2ECE.tmp"94⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"C:\Users\Admin\AppData\Local\Temp\2F1C.tmp"95⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"C:\Users\Admin\AppData\Local\Temp\2F5A.tmp"96⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\2F98.tmp"C:\Users\Admin\AppData\Local\Temp\2F98.tmp"97⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"C:\Users\Admin\AppData\Local\Temp\2FD7.tmp"98⤵PID:2460
-
C:\Users\Admin\AppData\Local\Temp\3015.tmp"C:\Users\Admin\AppData\Local\Temp\3015.tmp"99⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\3054.tmp"C:\Users\Admin\AppData\Local\Temp\3054.tmp"100⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\3092.tmp"C:\Users\Admin\AppData\Local\Temp\3092.tmp"101⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\30D0.tmp"C:\Users\Admin\AppData\Local\Temp\30D0.tmp"102⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\310F.tmp"C:\Users\Admin\AppData\Local\Temp\310F.tmp"103⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\314D.tmp"C:\Users\Admin\AppData\Local\Temp\314D.tmp"104⤵PID:2528
-
C:\Users\Admin\AppData\Local\Temp\318C.tmp"C:\Users\Admin\AppData\Local\Temp\318C.tmp"105⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\31CA.tmp"C:\Users\Admin\AppData\Local\Temp\31CA.tmp"106⤵PID:2636
-
C:\Users\Admin\AppData\Local\Temp\3208.tmp"C:\Users\Admin\AppData\Local\Temp\3208.tmp"107⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\3247.tmp"C:\Users\Admin\AppData\Local\Temp\3247.tmp"108⤵PID:2412
-
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"109⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\32C4.tmp"C:\Users\Admin\AppData\Local\Temp\32C4.tmp"110⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\3312.tmp"C:\Users\Admin\AppData\Local\Temp\3312.tmp"111⤵PID:2380
-
C:\Users\Admin\AppData\Local\Temp\3350.tmp"C:\Users\Admin\AppData\Local\Temp\3350.tmp"112⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\338E.tmp"C:\Users\Admin\AppData\Local\Temp\338E.tmp"113⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\33CD.tmp"C:\Users\Admin\AppData\Local\Temp\33CD.tmp"114⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\340B.tmp"C:\Users\Admin\AppData\Local\Temp\340B.tmp"115⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"116⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\3488.tmp"C:\Users\Admin\AppData\Local\Temp\3488.tmp"117⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\34C6.tmp"C:\Users\Admin\AppData\Local\Temp\34C6.tmp"118⤵PID:384
-
C:\Users\Admin\AppData\Local\Temp\3505.tmp"C:\Users\Admin\AppData\Local\Temp\3505.tmp"119⤵PID:1984
-
C:\Users\Admin\AppData\Local\Temp\3562.tmp"C:\Users\Admin\AppData\Local\Temp\3562.tmp"120⤵PID:320
-
C:\Users\Admin\AppData\Local\Temp\35A1.tmp"C:\Users\Admin\AppData\Local\Temp\35A1.tmp"121⤵PID:2128
-
C:\Users\Admin\AppData\Local\Temp\35DF.tmp"C:\Users\Admin\AppData\Local\Temp\35DF.tmp"122⤵PID:1220
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-