Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
18/02/2024, 18:41
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe
Resource
win7-20231215-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe
Resource
win10v2004-20231222-en
3 signatures
150 seconds
General
-
Target
2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe
-
Size
486KB
-
MD5
916c5e0b484c1d2ba85563b86ed3853e
-
SHA1
5c85dc1795a5bd51512b937e692910c44ccbb823
-
SHA256
d955f77979a040bff6f89920795445c29bc98df3ee608a75b85c4906575877b5
-
SHA512
63a59a3ec4696799fbbeb933ef3f270bf9f0c987142d7c31d723c225f304e763a3cce20a0b219ed554ddd019f9c2e7aae5861e6a8553c758d0d7ef2d3f983224
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7RIBXRr+MLiVV7ipUB46UJ9E2Ya8tq+JiVrCB:/U5rCOTeiDR8XFw7ip0ssEWiBzcjtNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3444 4F87.tmp 4684 5004.tmp 4884 5072.tmp 3880 50EF.tmp 5100 514C.tmp 3956 519A.tmp 4904 51E9.tmp 4272 5266.tmp 1596 52B4.tmp 3236 5321.tmp 3592 536F.tmp 1832 53CD.tmp 2916 541B.tmp 3452 5469.tmp 1896 54C7.tmp 900 5515.tmp 1364 5582.tmp 3476 55D1.tmp 4588 563E.tmp 464 56AB.tmp 4480 5719.tmp 4036 5776.tmp 3192 57C5.tmp 3992 5822.tmp 3888 5870.tmp 4320 58DE.tmp 2476 593C.tmp 4056 5999.tmp 1772 59F7.tmp 2116 5A64.tmp 5088 5AC2.tmp 1240 5B20.tmp 2652 5B6E.tmp 4028 5BCC.tmp 4276 5C1A.tmp 4580 5C68.tmp 2972 5CB6.tmp 3764 5D04.tmp 2428 5D62.tmp 2748 5DB0.tmp 4116 5DFE.tmp 3384 5E4C.tmp 1584 5E9B.tmp 3972 5EE9.tmp 5096 5F37.tmp 3772 5F85.tmp 1920 5FD3.tmp 4668 6021.tmp 1860 6189.tmp 2688 61D7.tmp 4376 6225.tmp 4344 6283.tmp 1460 62D1.tmp 2472 631F.tmp 552 636D.tmp 1980 63CB.tmp 4548 6419.tmp 2500 6467.tmp 2696 64B5.tmp 1448 6503.tmp 3032 6551.tmp 1544 659F.tmp 2716 65FD.tmp 3900 664B.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 804 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1460 wrote to memory of 3444 1460 2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe 86 PID 1460 wrote to memory of 3444 1460 2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe 86 PID 1460 wrote to memory of 3444 1460 2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe 86 PID 3444 wrote to memory of 4684 3444 4F87.tmp 87 PID 3444 wrote to memory of 4684 3444 4F87.tmp 87 PID 3444 wrote to memory of 4684 3444 4F87.tmp 87 PID 4684 wrote to memory of 4884 4684 5004.tmp 88 PID 4684 wrote to memory of 4884 4684 5004.tmp 88 PID 4684 wrote to memory of 4884 4684 5004.tmp 88 PID 4884 wrote to memory of 3880 4884 5072.tmp 89 PID 4884 wrote to memory of 3880 4884 5072.tmp 89 PID 4884 wrote to memory of 3880 4884 5072.tmp 89 PID 3880 wrote to memory of 5100 3880 50EF.tmp 90 PID 3880 wrote to memory of 5100 3880 50EF.tmp 90 PID 3880 wrote to memory of 5100 3880 50EF.tmp 90 PID 5100 wrote to memory of 3956 5100 514C.tmp 91 PID 5100 wrote to memory of 3956 5100 514C.tmp 91 PID 5100 wrote to memory of 3956 5100 514C.tmp 91 PID 3956 wrote to memory of 4904 3956 519A.tmp 92 PID 3956 wrote to memory of 4904 3956 519A.tmp 92 PID 3956 wrote to memory of 4904 3956 519A.tmp 92 PID 4904 wrote to memory of 4272 4904 51E9.tmp 93 PID 4904 wrote to memory of 4272 4904 51E9.tmp 93 PID 4904 wrote to memory of 4272 4904 51E9.tmp 93 PID 4272 wrote to memory of 1596 4272 5266.tmp 94 PID 4272 wrote to memory of 1596 4272 5266.tmp 94 PID 4272 wrote to memory of 1596 4272 5266.tmp 94 PID 1596 wrote to memory of 3236 1596 52B4.tmp 95 PID 1596 wrote to memory of 3236 1596 52B4.tmp 95 PID 1596 wrote to memory of 3236 1596 52B4.tmp 95 PID 3236 wrote to memory of 3592 3236 5321.tmp 96 PID 3236 wrote to memory of 3592 3236 5321.tmp 96 PID 3236 wrote to memory of 3592 3236 5321.tmp 96 PID 3592 wrote to memory of 1832 3592 536F.tmp 97 PID 3592 wrote to memory of 1832 3592 536F.tmp 97 PID 3592 wrote to memory of 1832 3592 536F.tmp 97 PID 1832 wrote to memory of 2916 1832 53CD.tmp 98 PID 1832 wrote to memory of 2916 1832 53CD.tmp 98 PID 1832 wrote to memory of 2916 1832 53CD.tmp 98 PID 2916 wrote to memory of 3452 2916 541B.tmp 99 PID 2916 wrote to memory of 3452 2916 541B.tmp 99 PID 2916 wrote to memory of 3452 2916 541B.tmp 99 PID 3452 wrote to memory of 1896 3452 5469.tmp 100 PID 3452 wrote to memory of 1896 3452 5469.tmp 100 PID 3452 wrote to memory of 1896 3452 5469.tmp 100 PID 1896 wrote to memory of 900 1896 54C7.tmp 101 PID 1896 wrote to memory of 900 1896 54C7.tmp 101 PID 1896 wrote to memory of 900 1896 54C7.tmp 101 PID 900 wrote to memory of 1364 900 5515.tmp 102 PID 900 wrote to memory of 1364 900 5515.tmp 102 PID 900 wrote to memory of 1364 900 5515.tmp 102 PID 1364 wrote to memory of 3476 1364 5582.tmp 103 PID 1364 wrote to memory of 3476 1364 5582.tmp 103 PID 1364 wrote to memory of 3476 1364 5582.tmp 103 PID 3476 wrote to memory of 4588 3476 55D1.tmp 104 PID 3476 wrote to memory of 4588 3476 55D1.tmp 104 PID 3476 wrote to memory of 4588 3476 55D1.tmp 104 PID 4588 wrote to memory of 464 4588 563E.tmp 105 PID 4588 wrote to memory of 464 4588 563E.tmp 105 PID 4588 wrote to memory of 464 4588 563E.tmp 105 PID 464 wrote to memory of 4480 464 56AB.tmp 106 PID 464 wrote to memory of 4480 464 56AB.tmp 106 PID 464 wrote to memory of 4480 464 56AB.tmp 106 PID 4480 wrote to memory of 4036 4480 5719.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_916c5e0b484c1d2ba85563b86ed3853e_mafia.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\4F87.tmp"C:\Users\Admin\AppData\Local\Temp\4F87.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\5072.tmp"C:\Users\Admin\AppData\Local\Temp\5072.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\514C.tmp"C:\Users\Admin\AppData\Local\Temp\514C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\519A.tmp"C:\Users\Admin\AppData\Local\Temp\519A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Users\Admin\AppData\Local\Temp\51E9.tmp"C:\Users\Admin\AppData\Local\Temp\51E9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\541B.tmp"C:\Users\Admin\AppData\Local\Temp\541B.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\5469.tmp"C:\Users\Admin\AppData\Local\Temp\5469.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Users\Admin\AppData\Local\Temp\54C7.tmp"C:\Users\Admin\AppData\Local\Temp\54C7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4588 -
C:\Users\Admin\AppData\Local\Temp\56AB.tmp"C:\Users\Admin\AppData\Local\Temp\56AB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"23⤵
- Executes dropped EXE
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"24⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"25⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"26⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"27⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"28⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"29⤵
- Executes dropped EXE
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"30⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"31⤵
- Executes dropped EXE
PID:2116 -
C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"C:\Users\Admin\AppData\Local\Temp\5AC2.tmp"32⤵
- Executes dropped EXE
PID:5088 -
C:\Users\Admin\AppData\Local\Temp\5B20.tmp"C:\Users\Admin\AppData\Local\Temp\5B20.tmp"33⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"C:\Users\Admin\AppData\Local\Temp\5B6E.tmp"34⤵
- Executes dropped EXE
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"C:\Users\Admin\AppData\Local\Temp\5BCC.tmp"35⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"C:\Users\Admin\AppData\Local\Temp\5C1A.tmp"36⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"37⤵
- Executes dropped EXE
PID:4580 -
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"38⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\5D04.tmp"C:\Users\Admin\AppData\Local\Temp\5D04.tmp"39⤵
- Executes dropped EXE
PID:3764 -
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"40⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"41⤵
- Executes dropped EXE
PID:2748 -
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"42⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"43⤵
- Executes dropped EXE
PID:3384 -
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"44⤵
- Executes dropped EXE
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"45⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"46⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"47⤵
- Executes dropped EXE
PID:3772 -
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"48⤵
- Executes dropped EXE
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"49⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\6189.tmp"C:\Users\Admin\AppData\Local\Temp\6189.tmp"50⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"51⤵
- Executes dropped EXE
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"52⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"53⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"54⤵
- Executes dropped EXE
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"55⤵
- Executes dropped EXE
PID:2472 -
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"56⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"57⤵
- Executes dropped EXE
PID:1980 -
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"58⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\6467.tmp"C:\Users\Admin\AppData\Local\Temp\6467.tmp"59⤵
- Executes dropped EXE
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"60⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"61⤵
- Executes dropped EXE
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\6551.tmp"C:\Users\Admin\AppData\Local\Temp\6551.tmp"62⤵
- Executes dropped EXE
PID:3032 -
C:\Users\Admin\AppData\Local\Temp\659F.tmp"C:\Users\Admin\AppData\Local\Temp\659F.tmp"63⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"64⤵
- Executes dropped EXE
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\664B.tmp"C:\Users\Admin\AppData\Local\Temp\664B.tmp"65⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"66⤵PID:2356
-
C:\Users\Admin\AppData\Local\Temp\66E8.tmp"C:\Users\Admin\AppData\Local\Temp\66E8.tmp"67⤵PID:4988
-
C:\Users\Admin\AppData\Local\Temp\6736.tmp"C:\Users\Admin\AppData\Local\Temp\6736.tmp"68⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\6793.tmp"C:\Users\Admin\AppData\Local\Temp\6793.tmp"69⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\67E2.tmp"C:\Users\Admin\AppData\Local\Temp\67E2.tmp"70⤵PID:624
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"71⤵PID:2488
-
C:\Users\Admin\AppData\Local\Temp\688D.tmp"C:\Users\Admin\AppData\Local\Temp\688D.tmp"72⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\68EB.tmp"C:\Users\Admin\AppData\Local\Temp\68EB.tmp"73⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\6939.tmp"C:\Users\Admin\AppData\Local\Temp\6939.tmp"74⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\6987.tmp"C:\Users\Admin\AppData\Local\Temp\6987.tmp"75⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"76⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"77⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"78⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"79⤵PID:4356
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"80⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"81⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"82⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\6C18.tmp"C:\Users\Admin\AppData\Local\Temp\6C18.tmp"83⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\6C75.tmp"C:\Users\Admin\AppData\Local\Temp\6C75.tmp"84⤵PID:4412
-
C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"C:\Users\Admin\AppData\Local\Temp\6CC4.tmp"85⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\6D12.tmp"C:\Users\Admin\AppData\Local\Temp\6D12.tmp"86⤵PID:3360
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"87⤵PID:4384
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"88⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"C:\Users\Admin\AppData\Local\Temp\6DFC.tmp"89⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"90⤵PID:920
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"91⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"C:\Users\Admin\AppData\Local\Temp\6EE6.tmp"92⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\6F35.tmp"C:\Users\Admin\AppData\Local\Temp\6F35.tmp"93⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6F83.tmp"C:\Users\Admin\AppData\Local\Temp\6F83.tmp"94⤵PID:3688
-
C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"C:\Users\Admin\AppData\Local\Temp\6FD1.tmp"95⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\701F.tmp"C:\Users\Admin\AppData\Local\Temp\701F.tmp"96⤵PID:1816
-
C:\Users\Admin\AppData\Local\Temp\706D.tmp"C:\Users\Admin\AppData\Local\Temp\706D.tmp"97⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\70CB.tmp"C:\Users\Admin\AppData\Local\Temp\70CB.tmp"98⤵PID:2796
-
C:\Users\Admin\AppData\Local\Temp\7119.tmp"C:\Users\Admin\AppData\Local\Temp\7119.tmp"99⤵PID:3412
-
C:\Users\Admin\AppData\Local\Temp\7167.tmp"C:\Users\Admin\AppData\Local\Temp\7167.tmp"100⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\71C5.tmp"C:\Users\Admin\AppData\Local\Temp\71C5.tmp"101⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\7213.tmp"C:\Users\Admin\AppData\Local\Temp\7213.tmp"102⤵PID:736
-
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"103⤵PID:2068
-
C:\Users\Admin\AppData\Local\Temp\72BF.tmp"C:\Users\Admin\AppData\Local\Temp\72BF.tmp"104⤵PID:3676
-
C:\Users\Admin\AppData\Local\Temp\731D.tmp"C:\Users\Admin\AppData\Local\Temp\731D.tmp"105⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\737A.tmp"C:\Users\Admin\AppData\Local\Temp\737A.tmp"106⤵PID:2504
-
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"107⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"108⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"109⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\74A3.tmp"C:\Users\Admin\AppData\Local\Temp\74A3.tmp"110⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\7501.tmp"C:\Users\Admin\AppData\Local\Temp\7501.tmp"111⤵PID:2336
-
C:\Users\Admin\AppData\Local\Temp\756E.tmp"C:\Users\Admin\AppData\Local\Temp\756E.tmp"112⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\75BC.tmp"C:\Users\Admin\AppData\Local\Temp\75BC.tmp"113⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\760B.tmp"C:\Users\Admin\AppData\Local\Temp\760B.tmp"114⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\7668.tmp"C:\Users\Admin\AppData\Local\Temp\7668.tmp"115⤵PID:4952
-
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"116⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\7705.tmp"C:\Users\Admin\AppData\Local\Temp\7705.tmp"117⤵PID:2284
-
C:\Users\Admin\AppData\Local\Temp\7762.tmp"C:\Users\Admin\AppData\Local\Temp\7762.tmp"118⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\77B0.tmp"C:\Users\Admin\AppData\Local\Temp\77B0.tmp"119⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\780E.tmp"C:\Users\Admin\AppData\Local\Temp\780E.tmp"120⤵PID:3112
-
C:\Users\Admin\AppData\Local\Temp\785C.tmp"C:\Users\Admin\AppData\Local\Temp\785C.tmp"121⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\78AA.tmp"C:\Users\Admin\AppData\Local\Temp\78AA.tmp"122⤵PID:372
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-