Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 22:52
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe
-
Size
520KB
-
MD5
9c93fdafecb97d120af49516181c9a74
-
SHA1
bf33dd543e2af6f09f07d0e05d7cc522640627b5
-
SHA256
beeff0ce4307e6284bd33a6a3ba56d2fa42b8c71eaf50c508cef01f15ee7e68b
-
SHA512
ed778e54620f28754b882cca0349a4559975f97e91ef393db9bb31e58b1de71f78fdfb91e3a9524339c60271eea95f22a54d6e3952bcb643f642e00aac820faf
-
SSDEEP
12288:gj8fuxR21t5i8fLh1NFvhGN8NOoU04hsmTk69KCdkxfNZ:gj8fuK1GYLhdVNOp0CJ3EN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 776 1B6.tmp 2028 213.tmp 2620 290.tmp 2696 2EE.tmp 2476 34B.tmp 2740 3C8.tmp 2492 435.tmp 1676 493.tmp 2488 500.tmp 2964 55E.tmp 320 5BB.tmp 2848 628.tmp 2940 686.tmp 2568 6E4.tmp 2796 751.tmp 1608 79F.tmp 2456 80C.tmp 1828 879.tmp 1920 8D7.tmp 2792 944.tmp 2256 992.tmp 1528 9FF.tmp 1756 A6C.tmp 1800 AAB.tmp 1960 AF9.tmp 2904 B47.tmp 3048 B95.tmp 2072 BD3.tmp 1888 C21.tmp 608 C60.tmp 544 C9E.tmp 712 CDC.tmp 1040 D1B.tmp 1680 D69.tmp 844 DB7.tmp 2368 E05.tmp 1536 E43.tmp 1780 E91.tmp 1708 ED0.tmp 2292 F0E.tmp 1540 F4C.tmp 1788 F8B.tmp 964 FD9.tmp 1916 1017.tmp 3008 1056.tmp 380 1094.tmp 2116 10E2.tmp 2396 1120.tmp 2376 115F.tmp 2916 119D.tmp 2408 11DC.tmp 1532 121A.tmp 908 1258.tmp 1748 12A6.tmp 308 12E5.tmp 1640 1333.tmp 1232 1371.tmp 2320 13BF.tmp 3032 13FE.tmp 2612 143C.tmp 2704 147A.tmp 2700 14E8.tmp 2896 1526.tmp 2504 1564.tmp -
Loads dropped DLL 64 IoCs
pid Process 2400 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 776 1B6.tmp 2028 213.tmp 2620 290.tmp 2696 2EE.tmp 2476 34B.tmp 2740 3C8.tmp 2492 435.tmp 1676 493.tmp 2488 500.tmp 2964 55E.tmp 320 5BB.tmp 2848 628.tmp 2940 686.tmp 2568 6E4.tmp 2796 751.tmp 1608 79F.tmp 2456 80C.tmp 1828 879.tmp 1920 8D7.tmp 2792 944.tmp 2256 992.tmp 1528 9FF.tmp 1756 A6C.tmp 1800 AAB.tmp 1960 AF9.tmp 2904 B47.tmp 3048 B95.tmp 2072 BD3.tmp 1888 C21.tmp 608 C60.tmp 544 C9E.tmp 712 CDC.tmp 1040 D1B.tmp 1680 D69.tmp 844 DB7.tmp 2368 E05.tmp 1536 E43.tmp 1780 E91.tmp 1708 ED0.tmp 2292 F0E.tmp 1540 F4C.tmp 1788 F8B.tmp 964 FD9.tmp 1916 1017.tmp 3008 1056.tmp 380 1094.tmp 2116 10E2.tmp 2396 1120.tmp 2376 115F.tmp 2916 119D.tmp 2408 11DC.tmp 1532 121A.tmp 908 1258.tmp 1748 12A6.tmp 308 12E5.tmp 1640 1333.tmp 1232 1371.tmp 2320 13BF.tmp 3032 13FE.tmp 2612 143C.tmp 2704 147A.tmp 2700 14E8.tmp 2896 1526.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2400 wrote to memory of 776 2400 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 28 PID 2400 wrote to memory of 776 2400 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 28 PID 2400 wrote to memory of 776 2400 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 28 PID 2400 wrote to memory of 776 2400 2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe 28 PID 776 wrote to memory of 2028 776 1B6.tmp 29 PID 776 wrote to memory of 2028 776 1B6.tmp 29 PID 776 wrote to memory of 2028 776 1B6.tmp 29 PID 776 wrote to memory of 2028 776 1B6.tmp 29 PID 2028 wrote to memory of 2620 2028 213.tmp 30 PID 2028 wrote to memory of 2620 2028 213.tmp 30 PID 2028 wrote to memory of 2620 2028 213.tmp 30 PID 2028 wrote to memory of 2620 2028 213.tmp 30 PID 2620 wrote to memory of 2696 2620 290.tmp 31 PID 2620 wrote to memory of 2696 2620 290.tmp 31 PID 2620 wrote to memory of 2696 2620 290.tmp 31 PID 2620 wrote to memory of 2696 2620 290.tmp 31 PID 2696 wrote to memory of 2476 2696 2EE.tmp 32 PID 2696 wrote to memory of 2476 2696 2EE.tmp 32 PID 2696 wrote to memory of 2476 2696 2EE.tmp 32 PID 2696 wrote to memory of 2476 2696 2EE.tmp 32 PID 2476 wrote to memory of 2740 2476 34B.tmp 33 PID 2476 wrote to memory of 2740 2476 34B.tmp 33 PID 2476 wrote to memory of 2740 2476 34B.tmp 33 PID 2476 wrote to memory of 2740 2476 34B.tmp 33 PID 2740 wrote to memory of 2492 2740 3C8.tmp 34 PID 2740 wrote to memory of 2492 2740 3C8.tmp 34 PID 2740 wrote to memory of 2492 2740 3C8.tmp 34 PID 2740 wrote to memory of 2492 2740 3C8.tmp 34 PID 2492 wrote to memory of 1676 2492 435.tmp 35 PID 2492 wrote to memory of 1676 2492 435.tmp 35 PID 2492 wrote to memory of 1676 2492 435.tmp 35 PID 2492 wrote to memory of 1676 2492 435.tmp 35 PID 1676 wrote to memory of 2488 1676 493.tmp 36 PID 1676 wrote to memory of 2488 1676 493.tmp 36 PID 1676 wrote to memory of 2488 1676 493.tmp 36 PID 1676 wrote to memory of 2488 1676 493.tmp 36 PID 2488 wrote to memory of 2964 2488 500.tmp 37 PID 2488 wrote to memory of 2964 2488 500.tmp 37 PID 2488 wrote to memory of 2964 2488 500.tmp 37 PID 2488 wrote to memory of 2964 2488 500.tmp 37 PID 2964 wrote to memory of 320 2964 55E.tmp 38 PID 2964 wrote to memory of 320 2964 55E.tmp 38 PID 2964 wrote to memory of 320 2964 55E.tmp 38 PID 2964 wrote to memory of 320 2964 55E.tmp 38 PID 320 wrote to memory of 2848 320 5BB.tmp 39 PID 320 wrote to memory of 2848 320 5BB.tmp 39 PID 320 wrote to memory of 2848 320 5BB.tmp 39 PID 320 wrote to memory of 2848 320 5BB.tmp 39 PID 2848 wrote to memory of 2940 2848 628.tmp 40 PID 2848 wrote to memory of 2940 2848 628.tmp 40 PID 2848 wrote to memory of 2940 2848 628.tmp 40 PID 2848 wrote to memory of 2940 2848 628.tmp 40 PID 2940 wrote to memory of 2568 2940 686.tmp 41 PID 2940 wrote to memory of 2568 2940 686.tmp 41 PID 2940 wrote to memory of 2568 2940 686.tmp 41 PID 2940 wrote to memory of 2568 2940 686.tmp 41 PID 2568 wrote to memory of 2796 2568 6E4.tmp 42 PID 2568 wrote to memory of 2796 2568 6E4.tmp 42 PID 2568 wrote to memory of 2796 2568 6E4.tmp 42 PID 2568 wrote to memory of 2796 2568 6E4.tmp 42 PID 2796 wrote to memory of 1608 2796 751.tmp 43 PID 2796 wrote to memory of 1608 2796 751.tmp 43 PID 2796 wrote to memory of 1608 2796 751.tmp 43 PID 2796 wrote to memory of 1608 2796 751.tmp 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_9c93fdafecb97d120af49516181c9a74_mafia.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\1B6.tmp"C:\Users\Admin\AppData\Local\Temp\1B6.tmp"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Users\Admin\AppData\Local\Temp\213.tmp"C:\Users\Admin\AppData\Local\Temp\213.tmp"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\290.tmp"C:\Users\Admin\AppData\Local\Temp\290.tmp"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2EE.tmp"C:\Users\Admin\AppData\Local\Temp\2EE.tmp"5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\34B.tmp"C:\Users\Admin\AppData\Local\Temp\34B.tmp"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\3C8.tmp"C:\Users\Admin\AppData\Local\Temp\3C8.tmp"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\435.tmp"C:\Users\Admin\AppData\Local\Temp\435.tmp"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\493.tmp"C:\Users\Admin\AppData\Local\Temp\493.tmp"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\500.tmp"C:\Users\Admin\AppData\Local\Temp\500.tmp"10⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2488 -
C:\Users\Admin\AppData\Local\Temp\55E.tmp"C:\Users\Admin\AppData\Local\Temp\55E.tmp"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\5BB.tmp"C:\Users\Admin\AppData\Local\Temp\5BB.tmp"12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Users\Admin\AppData\Local\Temp\628.tmp"C:\Users\Admin\AppData\Local\Temp\628.tmp"13⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\686.tmp"C:\Users\Admin\AppData\Local\Temp\686.tmp"14⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\6E4.tmp"C:\Users\Admin\AppData\Local\Temp\6E4.tmp"15⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Users\Admin\AppData\Local\Temp\751.tmp"C:\Users\Admin\AppData\Local\Temp\751.tmp"16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\79F.tmp"C:\Users\Admin\AppData\Local\Temp\79F.tmp"17⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\80C.tmp"C:\Users\Admin\AppData\Local\Temp\80C.tmp"18⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\879.tmp"C:\Users\Admin\AppData\Local\Temp\879.tmp"19⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\8D7.tmp"C:\Users\Admin\AppData\Local\Temp\8D7.tmp"20⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\944.tmp"C:\Users\Admin\AppData\Local\Temp\944.tmp"21⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2792 -
C:\Users\Admin\AppData\Local\Temp\992.tmp"C:\Users\Admin\AppData\Local\Temp\992.tmp"22⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\9FF.tmp"C:\Users\Admin\AppData\Local\Temp\9FF.tmp"23⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1528 -
C:\Users\Admin\AppData\Local\Temp\A6C.tmp"C:\Users\Admin\AppData\Local\Temp\A6C.tmp"24⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\AAB.tmp"C:\Users\Admin\AppData\Local\Temp\AAB.tmp"25⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\AF9.tmp"C:\Users\Admin\AppData\Local\Temp\AF9.tmp"26⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\B47.tmp"C:\Users\Admin\AppData\Local\Temp\B47.tmp"27⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2904 -
C:\Users\Admin\AppData\Local\Temp\B95.tmp"C:\Users\Admin\AppData\Local\Temp\B95.tmp"28⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\BD3.tmp"C:\Users\Admin\AppData\Local\Temp\BD3.tmp"29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\C21.tmp"C:\Users\Admin\AppData\Local\Temp\C21.tmp"30⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\C60.tmp"C:\Users\Admin\AppData\Local\Temp\C60.tmp"31⤵
- Executes dropped EXE
- Loads dropped DLL
PID:608 -
C:\Users\Admin\AppData\Local\Temp\C9E.tmp"C:\Users\Admin\AppData\Local\Temp\C9E.tmp"32⤵
- Executes dropped EXE
- Loads dropped DLL
PID:544 -
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"33⤵
- Executes dropped EXE
- Loads dropped DLL
PID:712 -
C:\Users\Admin\AppData\Local\Temp\D1B.tmp"C:\Users\Admin\AppData\Local\Temp\D1B.tmp"34⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"35⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\DB7.tmp"C:\Users\Admin\AppData\Local\Temp\DB7.tmp"36⤵
- Executes dropped EXE
- Loads dropped DLL
PID:844 -
C:\Users\Admin\AppData\Local\Temp\E05.tmp"C:\Users\Admin\AppData\Local\Temp\E05.tmp"37⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\E43.tmp"C:\Users\Admin\AppData\Local\Temp\E43.tmp"38⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"39⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\ED0.tmp"C:\Users\Admin\AppData\Local\Temp\ED0.tmp"40⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"41⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\F4C.tmp"C:\Users\Admin\AppData\Local\Temp\F4C.tmp"42⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"43⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\FD9.tmp"C:\Users\Admin\AppData\Local\Temp\FD9.tmp"44⤵
- Executes dropped EXE
- Loads dropped DLL
PID:964 -
C:\Users\Admin\AppData\Local\Temp\1017.tmp"C:\Users\Admin\AppData\Local\Temp\1017.tmp"45⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\1056.tmp"C:\Users\Admin\AppData\Local\Temp\1056.tmp"46⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\1094.tmp"C:\Users\Admin\AppData\Local\Temp\1094.tmp"47⤵
- Executes dropped EXE
- Loads dropped DLL
PID:380 -
C:\Users\Admin\AppData\Local\Temp\10E2.tmp"C:\Users\Admin\AppData\Local\Temp\10E2.tmp"48⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\1120.tmp"C:\Users\Admin\AppData\Local\Temp\1120.tmp"49⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\115F.tmp"C:\Users\Admin\AppData\Local\Temp\115F.tmp"50⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2376 -
C:\Users\Admin\AppData\Local\Temp\119D.tmp"C:\Users\Admin\AppData\Local\Temp\119D.tmp"51⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\11DC.tmp"C:\Users\Admin\AppData\Local\Temp\11DC.tmp"52⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\121A.tmp"C:\Users\Admin\AppData\Local\Temp\121A.tmp"53⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\1258.tmp"C:\Users\Admin\AppData\Local\Temp\1258.tmp"54⤵
- Executes dropped EXE
- Loads dropped DLL
PID:908 -
C:\Users\Admin\AppData\Local\Temp\12A6.tmp"C:\Users\Admin\AppData\Local\Temp\12A6.tmp"55⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\12E5.tmp"C:\Users\Admin\AppData\Local\Temp\12E5.tmp"56⤵
- Executes dropped EXE
- Loads dropped DLL
PID:308 -
C:\Users\Admin\AppData\Local\Temp\1333.tmp"C:\Users\Admin\AppData\Local\Temp\1333.tmp"57⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\1371.tmp"C:\Users\Admin\AppData\Local\Temp\1371.tmp"58⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\13BF.tmp"C:\Users\Admin\AppData\Local\Temp\13BF.tmp"59⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\13FE.tmp"C:\Users\Admin\AppData\Local\Temp\13FE.tmp"60⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\143C.tmp"C:\Users\Admin\AppData\Local\Temp\143C.tmp"61⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\147A.tmp"C:\Users\Admin\AppData\Local\Temp\147A.tmp"62⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\14E8.tmp"C:\Users\Admin\AppData\Local\Temp\14E8.tmp"63⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\1526.tmp"C:\Users\Admin\AppData\Local\Temp\1526.tmp"64⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\1564.tmp"C:\Users\Admin\AppData\Local\Temp\1564.tmp"65⤵
- Executes dropped EXE
PID:2504 -
C:\Users\Admin\AppData\Local\Temp\15A3.tmp"C:\Users\Admin\AppData\Local\Temp\15A3.tmp"66⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\15E1.tmp"C:\Users\Admin\AppData\Local\Temp\15E1.tmp"67⤵PID:2740
-
C:\Users\Admin\AppData\Local\Temp\1620.tmp"C:\Users\Admin\AppData\Local\Temp\1620.tmp"68⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\165E.tmp"C:\Users\Admin\AppData\Local\Temp\165E.tmp"69⤵PID:2712
-
C:\Users\Admin\AppData\Local\Temp\169C.tmp"C:\Users\Admin\AppData\Local\Temp\169C.tmp"70⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\16DB.tmp"C:\Users\Admin\AppData\Local\Temp\16DB.tmp"71⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1719.tmp"C:\Users\Admin\AppData\Local\Temp\1719.tmp"72⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\1758.tmp"C:\Users\Admin\AppData\Local\Temp\1758.tmp"73⤵PID:2972
-
C:\Users\Admin\AppData\Local\Temp\1796.tmp"C:\Users\Admin\AppData\Local\Temp\1796.tmp"74⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\17D4.tmp"C:\Users\Admin\AppData\Local\Temp\17D4.tmp"75⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\1813.tmp"C:\Users\Admin\AppData\Local\Temp\1813.tmp"76⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\1851.tmp"C:\Users\Admin\AppData\Local\Temp\1851.tmp"77⤵PID:2132
-
C:\Users\Admin\AppData\Local\Temp\189F.tmp"C:\Users\Admin\AppData\Local\Temp\189F.tmp"78⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\18DE.tmp"C:\Users\Admin\AppData\Local\Temp\18DE.tmp"79⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\192C.tmp"C:\Users\Admin\AppData\Local\Temp\192C.tmp"80⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\196A.tmp"C:\Users\Admin\AppData\Local\Temp\196A.tmp"81⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\19A8.tmp"C:\Users\Admin\AppData\Local\Temp\19A8.tmp"82⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\19E7.tmp"C:\Users\Admin\AppData\Local\Temp\19E7.tmp"83⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\1A35.tmp"C:\Users\Admin\AppData\Local\Temp\1A35.tmp"84⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\1A73.tmp"C:\Users\Admin\AppData\Local\Temp\1A73.tmp"85⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"C:\Users\Admin\AppData\Local\Temp\1AC1.tmp"86⤵PID:2760
-
C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"C:\Users\Admin\AppData\Local\Temp\1B0F.tmp"87⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"C:\Users\Admin\AppData\Local\Temp\1B5D.tmp"88⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"C:\Users\Admin\AppData\Local\Temp\1B9C.tmp"89⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"C:\Users\Admin\AppData\Local\Temp\1BDA.tmp"90⤵PID:1548
-
C:\Users\Admin\AppData\Local\Temp\1C28.tmp"C:\Users\Admin\AppData\Local\Temp\1C28.tmp"91⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\1C66.tmp"C:\Users\Admin\AppData\Local\Temp\1C66.tmp"92⤵PID:1456
-
C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"C:\Users\Admin\AppData\Local\Temp\1CA5.tmp"93⤵PID:1800
-
C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"C:\Users\Admin\AppData\Local\Temp\1CE3.tmp"94⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\1D31.tmp"C:\Users\Admin\AppData\Local\Temp\1D31.tmp"95⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\1D70.tmp"C:\Users\Admin\AppData\Local\Temp\1D70.tmp"96⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"C:\Users\Admin\AppData\Local\Temp\1DAE.tmp"97⤵PID:592
-
C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"C:\Users\Admin\AppData\Local\Temp\1DEC.tmp"98⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"C:\Users\Admin\AppData\Local\Temp\1E2B.tmp"99⤵PID:1172
-
C:\Users\Admin\AppData\Local\Temp\1E69.tmp"C:\Users\Admin\AppData\Local\Temp\1E69.tmp"100⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"C:\Users\Admin\AppData\Local\Temp\1EB7.tmp"101⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\1F05.tmp"C:\Users\Admin\AppData\Local\Temp\1F05.tmp"102⤵PID:1792
-
C:\Users\Admin\AppData\Local\Temp\1F44.tmp"C:\Users\Admin\AppData\Local\Temp\1F44.tmp"103⤵PID:880
-
C:\Users\Admin\AppData\Local\Temp\1F82.tmp"C:\Users\Admin\AppData\Local\Temp\1F82.tmp"104⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"C:\Users\Admin\AppData\Local\Temp\1FC0.tmp"105⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"C:\Users\Admin\AppData\Local\Temp\1FFF.tmp"106⤵PID:2036
-
C:\Users\Admin\AppData\Local\Temp\203D.tmp"C:\Users\Admin\AppData\Local\Temp\203D.tmp"107⤵PID:2164
-
C:\Users\Admin\AppData\Local\Temp\208B.tmp"C:\Users\Admin\AppData\Local\Temp\208B.tmp"108⤵PID:2080
-
C:\Users\Admin\AppData\Local\Temp\20D9.tmp"C:\Users\Admin\AppData\Local\Temp\20D9.tmp"109⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\2118.tmp"C:\Users\Admin\AppData\Local\Temp\2118.tmp"110⤵PID:1076
-
C:\Users\Admin\AppData\Local\Temp\2166.tmp"C:\Users\Admin\AppData\Local\Temp\2166.tmp"111⤵PID:1000
-
C:\Users\Admin\AppData\Local\Temp\21A4.tmp"C:\Users\Admin\AppData\Local\Temp\21A4.tmp"112⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\21E2.tmp"C:\Users\Admin\AppData\Local\Temp\21E2.tmp"113⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\2230.tmp"C:\Users\Admin\AppData\Local\Temp\2230.tmp"114⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\226F.tmp"C:\Users\Admin\AppData\Local\Temp\226F.tmp"115⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\22AD.tmp"C:\Users\Admin\AppData\Local\Temp\22AD.tmp"116⤵PID:2888
-
C:\Users\Admin\AppData\Local\Temp\22EC.tmp"C:\Users\Admin\AppData\Local\Temp\22EC.tmp"117⤵PID:500
-
C:\Users\Admin\AppData\Local\Temp\233A.tmp"C:\Users\Admin\AppData\Local\Temp\233A.tmp"118⤵PID:2032
-
C:\Users\Admin\AppData\Local\Temp\2378.tmp"C:\Users\Admin\AppData\Local\Temp\2378.tmp"119⤵PID:2936
-
C:\Users\Admin\AppData\Local\Temp\23C6.tmp"C:\Users\Admin\AppData\Local\Temp\23C6.tmp"120⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\2404.tmp"C:\Users\Admin\AppData\Local\Temp\2404.tmp"121⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\2443.tmp"C:\Users\Admin\AppData\Local\Temp\2443.tmp"122⤵PID:1672
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-