Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 16:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe
Resource
win10v2004-20230915-en
3 signatures
150 seconds
General
-
Target
2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe
-
Size
488KB
-
MD5
1f5a1caa27d9f398c30efa903ee47134
-
SHA1
5830d18c700c28a144085df48dbf8f08de365652
-
SHA256
8177599f01949ab3c0078895280d1ffa65b3a82516330f9b9618396343914c43
-
SHA512
d88c3d5f86518d34f6e330baa53f2bdac40f1613725c626e0e54a9ffeba6be157b19bc2f5eda7f592970ad2531562b61e003cc8b007474c6e99200428e4394cd
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7S12YMQd3SIFrMrAmCVe5o8Q1AjEiVrrIsH3j:/U5rCOTeiDYMQvWAmfhcFiFNNZ
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5064 7D6D.tmp 4560 7E48.tmp 4352 7ED5.tmp 3376 7FCF.tmp 644 806B.tmp 3404 80F7.tmp 4272 81E2.tmp 3740 825F.tmp 1356 82DC.tmp 5108 8359.tmp 1064 83D6.tmp 4028 8482.tmp 1848 84FF.tmp 4044 85D9.tmp 4708 878F.tmp 5024 884A.tmp 1792 88F6.tmp 2388 8973.tmp 4452 8A00.tmp 4728 8A7D.tmp 1824 8B96.tmp 3892 8C13.tmp 3732 8CAF.tmp 4048 8D2C.tmp 3128 8DC9.tmp 2536 8E94.tmp 3076 8F20.tmp 1160 8FBD.tmp 4696 9078.tmp 4472 90F5.tmp 4992 91EF.tmp 4320 92AB.tmp 1720 9347.tmp 5116 93D4.tmp 4752 9451.tmp 352 94DD.tmp 3008 956A.tmp 3736 95F6.tmp 4460 9673.tmp 4272 9710.tmp 4700 977D.tmp 4396 980A.tmp 2252 9887.tmp 5108 9971.tmp 2192 99EE.tmp 3948 9A7B.tmp 4664 9AE8.tmp 2980 9BA4.tmp 3904 9C8E.tmp 2012 9CEC.tmp 3836 9D69.tmp 1984 9DD6.tmp 1792 9E53.tmp 2388 9EEF.tmp 3360 9F7C.tmp 3340 A009.tmp 3436 A0A5.tmp 3428 A131.tmp 1592 A1DD.tmp 1548 A24B.tmp 2276 A2C8.tmp 3752 A335.tmp 2096 A3B2.tmp 4424 A41F.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 1536 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 408 wrote to memory of 5064 408 2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe 83 PID 408 wrote to memory of 5064 408 2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe 83 PID 408 wrote to memory of 5064 408 2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe 83 PID 5064 wrote to memory of 4560 5064 7D6D.tmp 84 PID 5064 wrote to memory of 4560 5064 7D6D.tmp 84 PID 5064 wrote to memory of 4560 5064 7D6D.tmp 84 PID 4560 wrote to memory of 4352 4560 7E48.tmp 85 PID 4560 wrote to memory of 4352 4560 7E48.tmp 85 PID 4560 wrote to memory of 4352 4560 7E48.tmp 85 PID 4352 wrote to memory of 3376 4352 7ED5.tmp 86 PID 4352 wrote to memory of 3376 4352 7ED5.tmp 86 PID 4352 wrote to memory of 3376 4352 7ED5.tmp 86 PID 3376 wrote to memory of 644 3376 7FCF.tmp 87 PID 3376 wrote to memory of 644 3376 7FCF.tmp 87 PID 3376 wrote to memory of 644 3376 7FCF.tmp 87 PID 644 wrote to memory of 3404 644 806B.tmp 88 PID 644 wrote to memory of 3404 644 806B.tmp 88 PID 644 wrote to memory of 3404 644 806B.tmp 88 PID 3404 wrote to memory of 4272 3404 80F7.tmp 89 PID 3404 wrote to memory of 4272 3404 80F7.tmp 89 PID 3404 wrote to memory of 4272 3404 80F7.tmp 89 PID 4272 wrote to memory of 3740 4272 81E2.tmp 90 PID 4272 wrote to memory of 3740 4272 81E2.tmp 90 PID 4272 wrote to memory of 3740 4272 81E2.tmp 90 PID 3740 wrote to memory of 1356 3740 825F.tmp 91 PID 3740 wrote to memory of 1356 3740 825F.tmp 91 PID 3740 wrote to memory of 1356 3740 825F.tmp 91 PID 1356 wrote to memory of 5108 1356 82DC.tmp 92 PID 1356 wrote to memory of 5108 1356 82DC.tmp 92 PID 1356 wrote to memory of 5108 1356 82DC.tmp 92 PID 5108 wrote to memory of 1064 5108 8359.tmp 95 PID 5108 wrote to memory of 1064 5108 8359.tmp 95 PID 5108 wrote to memory of 1064 5108 8359.tmp 95 PID 1064 wrote to memory of 4028 1064 83D6.tmp 97 PID 1064 wrote to memory of 4028 1064 83D6.tmp 97 PID 1064 wrote to memory of 4028 1064 83D6.tmp 97 PID 4028 wrote to memory of 1848 4028 8482.tmp 98 PID 4028 wrote to memory of 1848 4028 8482.tmp 98 PID 4028 wrote to memory of 1848 4028 8482.tmp 98 PID 1848 wrote to memory of 4044 1848 84FF.tmp 99 PID 1848 wrote to memory of 4044 1848 84FF.tmp 99 PID 1848 wrote to memory of 4044 1848 84FF.tmp 99 PID 4044 wrote to memory of 4708 4044 85D9.tmp 102 PID 4044 wrote to memory of 4708 4044 85D9.tmp 102 PID 4044 wrote to memory of 4708 4044 85D9.tmp 102 PID 4708 wrote to memory of 5024 4708 878F.tmp 103 PID 4708 wrote to memory of 5024 4708 878F.tmp 103 PID 4708 wrote to memory of 5024 4708 878F.tmp 103 PID 5024 wrote to memory of 1792 5024 884A.tmp 104 PID 5024 wrote to memory of 1792 5024 884A.tmp 104 PID 5024 wrote to memory of 1792 5024 884A.tmp 104 PID 1792 wrote to memory of 2388 1792 88F6.tmp 105 PID 1792 wrote to memory of 2388 1792 88F6.tmp 105 PID 1792 wrote to memory of 2388 1792 88F6.tmp 105 PID 2388 wrote to memory of 4452 2388 8973.tmp 106 PID 2388 wrote to memory of 4452 2388 8973.tmp 106 PID 2388 wrote to memory of 4452 2388 8973.tmp 106 PID 4452 wrote to memory of 4728 4452 8A00.tmp 108 PID 4452 wrote to memory of 4728 4452 8A00.tmp 108 PID 4452 wrote to memory of 4728 4452 8A00.tmp 108 PID 4728 wrote to memory of 1824 4728 8A7D.tmp 109 PID 4728 wrote to memory of 1824 4728 8A7D.tmp 109 PID 4728 wrote to memory of 1824 4728 8A7D.tmp 109 PID 1824 wrote to memory of 3892 1824 8B96.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_1f5a1caa27d9f398c30efa903ee47134_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:408 -
C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"C:\Users\Admin\AppData\Local\Temp\7D6D.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Local\Temp\7E48.tmp"C:\Users\Admin\AppData\Local\Temp\7E48.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"C:\Users\Admin\AppData\Local\Temp\7ED5.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"C:\Users\Admin\AppData\Local\Temp\7FCF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\806B.tmp"C:\Users\Admin\AppData\Local\Temp\806B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Users\Admin\AppData\Local\Temp\80F7.tmp"C:\Users\Admin\AppData\Local\Temp\80F7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\82DC.tmp"C:\Users\Admin\AppData\Local\Temp\82DC.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\8359.tmp"C:\Users\Admin\AppData\Local\Temp\8359.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\83D6.tmp"C:\Users\Admin\AppData\Local\Temp\83D6.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\84FF.tmp"C:\Users\Admin\AppData\Local\Temp\84FF.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Users\Admin\AppData\Local\Temp\85D9.tmp"C:\Users\Admin\AppData\Local\Temp\85D9.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\884A.tmp"C:\Users\Admin\AppData\Local\Temp\884A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\88F6.tmp"C:\Users\Admin\AppData\Local\Temp\88F6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"C:\Users\Admin\AppData\Local\Temp\8A7D.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\8B96.tmp"C:\Users\Admin\AppData\Local\Temp\8B96.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\8C13.tmp"C:\Users\Admin\AppData\Local\Temp\8C13.tmp"23⤵
- Executes dropped EXE
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"C:\Users\Admin\AppData\Local\Temp\8CAF.tmp"24⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"25⤵
- Executes dropped EXE
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"C:\Users\Admin\AppData\Local\Temp\8DC9.tmp"26⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"27⤵
- Executes dropped EXE
PID:2536 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"28⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"29⤵
- Executes dropped EXE
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"30⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"31⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\91EF.tmp"C:\Users\Admin\AppData\Local\Temp\91EF.tmp"32⤵
- Executes dropped EXE
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"33⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\9347.tmp"C:\Users\Admin\AppData\Local\Temp\9347.tmp"34⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\93D4.tmp"C:\Users\Admin\AppData\Local\Temp\93D4.tmp"35⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"36⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"37⤵
- Executes dropped EXE
PID:352 -
C:\Users\Admin\AppData\Local\Temp\956A.tmp"C:\Users\Admin\AppData\Local\Temp\956A.tmp"38⤵
- Executes dropped EXE
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\95F6.tmp"C:\Users\Admin\AppData\Local\Temp\95F6.tmp"39⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"40⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"41⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\977D.tmp"C:\Users\Admin\AppData\Local\Temp\977D.tmp"42⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\980A.tmp"C:\Users\Admin\AppData\Local\Temp\980A.tmp"43⤵
- Executes dropped EXE
PID:4396 -
C:\Users\Admin\AppData\Local\Temp\9887.tmp"C:\Users\Admin\AppData\Local\Temp\9887.tmp"44⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"45⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\99EE.tmp"C:\Users\Admin\AppData\Local\Temp\99EE.tmp"46⤵
- Executes dropped EXE
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"47⤵
- Executes dropped EXE
PID:3948 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"48⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"49⤵
- Executes dropped EXE
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"C:\Users\Admin\AppData\Local\Temp\9C8E.tmp"50⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"C:\Users\Admin\AppData\Local\Temp\9CEC.tmp"51⤵
- Executes dropped EXE
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\9D69.tmp"C:\Users\Admin\AppData\Local\Temp\9D69.tmp"52⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"C:\Users\Admin\AppData\Local\Temp\9DD6.tmp"53⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"54⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"C:\Users\Admin\AppData\Local\Temp\9EEF.tmp"55⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"56⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\A009.tmp"C:\Users\Admin\AppData\Local\Temp\A009.tmp"57⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"58⤵
- Executes dropped EXE
PID:3436 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"59⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"60⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"61⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"62⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"63⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"C:\Users\Admin\AppData\Local\Temp\A3B2.tmp"64⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"65⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\A48D.tmp"C:\Users\Admin\AppData\Local\Temp\A48D.tmp"66⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"67⤵PID:1160
-
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"68⤵PID:3368
-
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"69⤵PID:4612
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"70⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"71⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"72⤵PID:4560
-
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"73⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"74⤵PID:2632
-
C:\Users\Admin\AppData\Local\Temp\A97E.tmp"C:\Users\Admin\AppData\Local\Temp\A97E.tmp"75⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"C:\Users\Admin\AppData\Local\Temp\A9DC.tmp"76⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"C:\Users\Admin\AppData\Local\Temp\AA4A.tmp"77⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"78⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"79⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"80⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"C:\Users\Admin\AppData\Local\Temp\ACCA.tmp"81⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\AD47.tmp"C:\Users\Admin\AppData\Local\Temp\AD47.tmp"82⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"83⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"84⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"85⤵PID:3536
-
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"86⤵PID:1016
-
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"87⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"88⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"89⤵PID:416
-
C:\Users\Admin\AppData\Local\Temp\B12F.tmp"C:\Users\Admin\AppData\Local\Temp\B12F.tmp"90⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"C:\Users\Admin\AppData\Local\Temp\B1AC.tmp"91⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"92⤵PID:828
-
C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"C:\Users\Admin\AppData\Local\Temp\B2E5.tmp"93⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\B362.tmp"C:\Users\Admin\AppData\Local\Temp\B362.tmp"94⤵PID:4452
-
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"95⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B47B.tmp"C:\Users\Admin\AppData\Local\Temp\B47B.tmp"96⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"97⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"98⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"99⤵PID:3492
-
C:\Users\Admin\AppData\Local\Temp\B67F.tmp"C:\Users\Admin\AppData\Local\Temp\B67F.tmp"100⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\B70B.tmp"C:\Users\Admin\AppData\Local\Temp\B70B.tmp"101⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B779.tmp"C:\Users\Admin\AppData\Local\Temp\B779.tmp"102⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"C:\Users\Admin\AppData\Local\Temp\B7E6.tmp"103⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"104⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"105⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B93E.tmp"C:\Users\Admin\AppData\Local\Temp\B93E.tmp"106⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"C:\Users\Admin\AppData\Local\Temp\B9AB.tmp"107⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\BA28.tmp"C:\Users\Admin\AppData\Local\Temp\BA28.tmp"108⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"C:\Users\Admin\AppData\Local\Temp\BAC4.tmp"109⤵PID:456
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"110⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"111⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"112⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"113⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"114⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"C:\Users\Admin\AppData\Local\Temp\BDC2.tmp"115⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"116⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"C:\Users\Admin\AppData\Local\Temp\BEDB.tmp"117⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\BF68.tmp"C:\Users\Admin\AppData\Local\Temp\BF68.tmp"118⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\C004.tmp"C:\Users\Admin\AppData\Local\Temp\C004.tmp"119⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\C081.tmp"C:\Users\Admin\AppData\Local\Temp\C081.tmp"120⤵PID:1568
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"121⤵PID:3012
-
C:\Users\Admin\AppData\Local\Temp\C265.tmp"C:\Users\Admin\AppData\Local\Temp\C265.tmp"122⤵PID:1016
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-