Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 18:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe
Resource
win10v2004-20230915-en
3 signatures
150 seconds
General
-
Target
2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe
-
Size
486KB
-
MD5
40c1bde0783cbf0509e9342ef2fd4e44
-
SHA1
4b1637b6dcdbdacf6eaf483fe4a377b3322d7524
-
SHA256
ed94c5ac7d4351fa394ff79bc103dc376317749a825110c4769801b242594fdd
-
SHA512
e527421028df1f653c78733b60a6d96e58dfdabf64b6bdb078f76f3c0543eaaf01cdea425ea59dac3cb7be956d9157231f0bbdcf99275407d015ed7d3677dd82
-
SSDEEP
12288:/U5rCOTeiDSduZWyRhejNm0XrsxUHn4mNZ:/UQOJDguZWyRh0N2UHhN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4644 7290.tmp 4220 735B.tmp 4968 7407.tmp 4284 74B3.tmp 4912 757E.tmp 3424 761A.tmp 4560 76B6.tmp 4464 7791.tmp 3600 784D.tmp 1036 78CA.tmp 3420 7966.tmp 5044 7A21.tmp 2024 7ABE.tmp 2256 7B2B.tmp 848 7C44.tmp 5052 7CF0.tmp 3896 7DAC.tmp 4600 7E58.tmp 2704 7EE4.tmp 3164 7F90.tmp 4112 80D8.tmp 1340 8165.tmp 3816 81E2.tmp 2512 826E.tmp 4388 831A.tmp 3360 83E5.tmp 2288 8472.tmp 1772 852E.tmp 4624 85E9.tmp 996 8685.tmp 2856 8731.tmp 1588 87ED.tmp 412 8889.tmp 4852 8906.tmp 540 8973.tmp 740 8A00.tmp 3836 8A5E.tmp 4296 8B67.tmp 2628 8BC5.tmp 4928 8C42.tmp 2572 8CBF.tmp 3088 8D2C.tmp 4560 8D8A.tmp 4464 8E36.tmp 3240 8EC3.tmp 3596 8F6F.tmp 4860 8FDC.tmp 3616 9049.tmp 3244 90E6.tmp 1084 9172.tmp 2256 91FF.tmp 1912 928B.tmp 1488 9308.tmp 1288 9385.tmp 3896 9431.tmp 4600 94FC.tmp 3904 955A.tmp 4916 95E7.tmp 2492 9673.tmp 4112 9710.tmp 1544 978D.tmp 1204 9829.tmp 2288 9896.tmp 2608 9904.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 3588 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4772 wrote to memory of 4644 4772 2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe 84 PID 4772 wrote to memory of 4644 4772 2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe 84 PID 4772 wrote to memory of 4644 4772 2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe 84 PID 4644 wrote to memory of 4220 4644 7290.tmp 85 PID 4644 wrote to memory of 4220 4644 7290.tmp 85 PID 4644 wrote to memory of 4220 4644 7290.tmp 85 PID 4220 wrote to memory of 4968 4220 735B.tmp 86 PID 4220 wrote to memory of 4968 4220 735B.tmp 86 PID 4220 wrote to memory of 4968 4220 735B.tmp 86 PID 4968 wrote to memory of 4284 4968 7407.tmp 87 PID 4968 wrote to memory of 4284 4968 7407.tmp 87 PID 4968 wrote to memory of 4284 4968 7407.tmp 87 PID 4284 wrote to memory of 4912 4284 74B3.tmp 88 PID 4284 wrote to memory of 4912 4284 74B3.tmp 88 PID 4284 wrote to memory of 4912 4284 74B3.tmp 88 PID 4912 wrote to memory of 3424 4912 757E.tmp 89 PID 4912 wrote to memory of 3424 4912 757E.tmp 89 PID 4912 wrote to memory of 3424 4912 757E.tmp 89 PID 3424 wrote to memory of 4560 3424 761A.tmp 90 PID 3424 wrote to memory of 4560 3424 761A.tmp 90 PID 3424 wrote to memory of 4560 3424 761A.tmp 90 PID 4560 wrote to memory of 4464 4560 76B6.tmp 91 PID 4560 wrote to memory of 4464 4560 76B6.tmp 91 PID 4560 wrote to memory of 4464 4560 76B6.tmp 91 PID 4464 wrote to memory of 3600 4464 7791.tmp 92 PID 4464 wrote to memory of 3600 4464 7791.tmp 92 PID 4464 wrote to memory of 3600 4464 7791.tmp 92 PID 3600 wrote to memory of 1036 3600 784D.tmp 93 PID 3600 wrote to memory of 1036 3600 784D.tmp 93 PID 3600 wrote to memory of 1036 3600 784D.tmp 93 PID 1036 wrote to memory of 3420 1036 78CA.tmp 94 PID 1036 wrote to memory of 3420 1036 78CA.tmp 94 PID 1036 wrote to memory of 3420 1036 78CA.tmp 94 PID 3420 wrote to memory of 5044 3420 7966.tmp 95 PID 3420 wrote to memory of 5044 3420 7966.tmp 95 PID 3420 wrote to memory of 5044 3420 7966.tmp 95 PID 5044 wrote to memory of 2024 5044 7A21.tmp 96 PID 5044 wrote to memory of 2024 5044 7A21.tmp 96 PID 5044 wrote to memory of 2024 5044 7A21.tmp 96 PID 2024 wrote to memory of 2256 2024 7ABE.tmp 99 PID 2024 wrote to memory of 2256 2024 7ABE.tmp 99 PID 2024 wrote to memory of 2256 2024 7ABE.tmp 99 PID 2256 wrote to memory of 848 2256 7B2B.tmp 100 PID 2256 wrote to memory of 848 2256 7B2B.tmp 100 PID 2256 wrote to memory of 848 2256 7B2B.tmp 100 PID 848 wrote to memory of 5052 848 7C44.tmp 101 PID 848 wrote to memory of 5052 848 7C44.tmp 101 PID 848 wrote to memory of 5052 848 7C44.tmp 101 PID 5052 wrote to memory of 3896 5052 7CF0.tmp 102 PID 5052 wrote to memory of 3896 5052 7CF0.tmp 102 PID 5052 wrote to memory of 3896 5052 7CF0.tmp 102 PID 3896 wrote to memory of 4600 3896 7DAC.tmp 103 PID 3896 wrote to memory of 4600 3896 7DAC.tmp 103 PID 3896 wrote to memory of 4600 3896 7DAC.tmp 103 PID 4600 wrote to memory of 2704 4600 7E58.tmp 104 PID 4600 wrote to memory of 2704 4600 7E58.tmp 104 PID 4600 wrote to memory of 2704 4600 7E58.tmp 104 PID 2704 wrote to memory of 3164 2704 7EE4.tmp 106 PID 2704 wrote to memory of 3164 2704 7EE4.tmp 106 PID 2704 wrote to memory of 3164 2704 7EE4.tmp 106 PID 3164 wrote to memory of 4112 3164 7F90.tmp 107 PID 3164 wrote to memory of 4112 3164 7F90.tmp 107 PID 3164 wrote to memory of 4112 3164 7F90.tmp 107 PID 4112 wrote to memory of 1340 4112 80D8.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_40c1bde0783cbf0509e9342ef2fd4e44_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\7290.tmp"C:\Users\Admin\AppData\Local\Temp\7290.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\735B.tmp"C:\Users\Admin\AppData\Local\Temp\735B.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Users\Admin\AppData\Local\Temp\7407.tmp"C:\Users\Admin\AppData\Local\Temp\7407.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Local\Temp\74B3.tmp"C:\Users\Admin\AppData\Local\Temp\74B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\757E.tmp"C:\Users\Admin\AppData\Local\Temp\757E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Users\Admin\AppData\Local\Temp\76B6.tmp"C:\Users\Admin\AppData\Local\Temp\76B6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\7791.tmp"C:\Users\Admin\AppData\Local\Temp\7791.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\784D.tmp"C:\Users\Admin\AppData\Local\Temp\784D.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\78CA.tmp"C:\Users\Admin\AppData\Local\Temp\78CA.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\7966.tmp"C:\Users\Admin\AppData\Local\Temp\7966.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3420 -
C:\Users\Admin\AppData\Local\Temp\7A21.tmp"C:\Users\Admin\AppData\Local\Temp\7A21.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"C:\Users\Admin\AppData\Local\Temp\7ABE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"C:\Users\Admin\AppData\Local\Temp\7B2B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\7C44.tmp"C:\Users\Admin\AppData\Local\Temp\7C44.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"C:\Users\Admin\AppData\Local\Temp\7DAC.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\7E58.tmp"C:\Users\Admin\AppData\Local\Temp\7E58.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"C:\Users\Admin\AppData\Local\Temp\7EE4.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\7F90.tmp"C:\Users\Admin\AppData\Local\Temp\7F90.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\8165.tmp"C:\Users\Admin\AppData\Local\Temp\8165.tmp"23⤵
- Executes dropped EXE
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\81E2.tmp"C:\Users\Admin\AppData\Local\Temp\81E2.tmp"24⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\826E.tmp"C:\Users\Admin\AppData\Local\Temp\826E.tmp"25⤵
- Executes dropped EXE
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\831A.tmp"C:\Users\Admin\AppData\Local\Temp\831A.tmp"26⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"27⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\8472.tmp"C:\Users\Admin\AppData\Local\Temp\8472.tmp"28⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\852E.tmp"C:\Users\Admin\AppData\Local\Temp\852E.tmp"29⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"30⤵
- Executes dropped EXE
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\8685.tmp"C:\Users\Admin\AppData\Local\Temp\8685.tmp"31⤵
- Executes dropped EXE
PID:996 -
C:\Users\Admin\AppData\Local\Temp\8731.tmp"C:\Users\Admin\AppData\Local\Temp\8731.tmp"32⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\87ED.tmp"C:\Users\Admin\AppData\Local\Temp\87ED.tmp"33⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\8889.tmp"C:\Users\Admin\AppData\Local\Temp\8889.tmp"34⤵
- Executes dropped EXE
PID:412 -
C:\Users\Admin\AppData\Local\Temp\8906.tmp"C:\Users\Admin\AppData\Local\Temp\8906.tmp"35⤵
- Executes dropped EXE
PID:4852 -
C:\Users\Admin\AppData\Local\Temp\8973.tmp"C:\Users\Admin\AppData\Local\Temp\8973.tmp"36⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\8A00.tmp"C:\Users\Admin\AppData\Local\Temp\8A00.tmp"37⤵
- Executes dropped EXE
PID:740 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"38⤵
- Executes dropped EXE
PID:3836 -
C:\Users\Admin\AppData\Local\Temp\8B67.tmp"C:\Users\Admin\AppData\Local\Temp\8B67.tmp"39⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"C:\Users\Admin\AppData\Local\Temp\8BC5.tmp"40⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\8C42.tmp"C:\Users\Admin\AppData\Local\Temp\8C42.tmp"41⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"42⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"43⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"44⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\8E36.tmp"C:\Users\Admin\AppData\Local\Temp\8E36.tmp"45⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"C:\Users\Admin\AppData\Local\Temp\8EC3.tmp"46⤵
- Executes dropped EXE
PID:3240 -
C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"C:\Users\Admin\AppData\Local\Temp\8F6F.tmp"47⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"C:\Users\Admin\AppData\Local\Temp\8FDC.tmp"48⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"49⤵
- Executes dropped EXE
PID:3616 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"50⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\9172.tmp"C:\Users\Admin\AppData\Local\Temp\9172.tmp"51⤵
- Executes dropped EXE
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\91FF.tmp"C:\Users\Admin\AppData\Local\Temp\91FF.tmp"52⤵
- Executes dropped EXE
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\928B.tmp"C:\Users\Admin\AppData\Local\Temp\928B.tmp"53⤵
- Executes dropped EXE
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"54⤵
- Executes dropped EXE
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\9385.tmp"C:\Users\Admin\AppData\Local\Temp\9385.tmp"55⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\9431.tmp"C:\Users\Admin\AppData\Local\Temp\9431.tmp"56⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\94FC.tmp"C:\Users\Admin\AppData\Local\Temp\94FC.tmp"57⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\955A.tmp"C:\Users\Admin\AppData\Local\Temp\955A.tmp"58⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\95E7.tmp"C:\Users\Admin\AppData\Local\Temp\95E7.tmp"59⤵
- Executes dropped EXE
PID:4916 -
C:\Users\Admin\AppData\Local\Temp\9673.tmp"C:\Users\Admin\AppData\Local\Temp\9673.tmp"60⤵
- Executes dropped EXE
PID:2492 -
C:\Users\Admin\AppData\Local\Temp\9710.tmp"C:\Users\Admin\AppData\Local\Temp\9710.tmp"61⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"62⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\9829.tmp"C:\Users\Admin\AppData\Local\Temp\9829.tmp"63⤵
- Executes dropped EXE
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\9896.tmp"C:\Users\Admin\AppData\Local\Temp\9896.tmp"64⤵
- Executes dropped EXE
PID:2288 -
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"65⤵
- Executes dropped EXE
PID:2608 -
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"66⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"67⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"68⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"C:\Users\Admin\AppData\Local\Temp\9AC9.tmp"69⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"70⤵PID:1588
-
C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"C:\Users\Admin\AppData\Local\Temp\9BA4.tmp"71⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"72⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"C:\Users\Admin\AppData\Local\Temp\9CCC.tmp"73⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"74⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\9D98.tmp"C:\Users\Admin\AppData\Local\Temp\9D98.tmp"75⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"C:\Users\Admin\AppData\Local\Temp\9DF5.tmp"76⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"77⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"78⤵PID:3344
-
C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"C:\Users\Admin\AppData\Local\Temp\9F7C.tmp"79⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"C:\Users\Admin\AppData\Local\Temp\9FF9.tmp"80⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"81⤵PID:3632
-
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"82⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\A19F.tmp"C:\Users\Admin\AppData\Local\Temp\A19F.tmp"83⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\A22B.tmp"C:\Users\Admin\AppData\Local\Temp\A22B.tmp"84⤵PID:680
-
C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"C:\Users\Admin\AppData\Local\Temp\A2B8.tmp"85⤵PID:4944
-
C:\Users\Admin\AppData\Local\Temp\A335.tmp"C:\Users\Admin\AppData\Local\Temp\A335.tmp"86⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"87⤵PID:4288
-
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"88⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"89⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"C:\Users\Admin\AppData\Local\Temp\A4DB.tmp"90⤵PID:3616
-
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"91⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"C:\Users\Admin\AppData\Local\Temp\A5D5.tmp"92⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\A652.tmp"C:\Users\Admin\AppData\Local\Temp\A652.tmp"93⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"94⤵PID:3404
-
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"95⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"96⤵PID:3304
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"97⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"C:\Users\Admin\AppData\Local\Temp\A8F2.tmp"98⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\A950.tmp"C:\Users\Admin\AppData\Local\Temp\A950.tmp"99⤵PID:3256
-
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"100⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"C:\Users\Admin\AppData\Local\Temp\AA3A.tmp"101⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"102⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"103⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"104⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"105⤵PID:1848
-
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"106⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"107⤵PID:1712
-
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"108⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"109⤵PID:3444
-
C:\Users\Admin\AppData\Local\Temp\AE41.tmp"C:\Users\Admin\AppData\Local\Temp\AE41.tmp"110⤵PID:388
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"111⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"112⤵PID:112
-
C:\Users\Admin\AppData\Local\Temp\AF99.tmp"C:\Users\Admin\AppData\Local\Temp\AF99.tmp"113⤵PID:3724
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"114⤵PID:1540
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"115⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\B110.tmp"C:\Users\Admin\AppData\Local\Temp\B110.tmp"116⤵PID:3800
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"117⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\B229.tmp"C:\Users\Admin\AppData\Local\Temp\B229.tmp"118⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"119⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"C:\Users\Admin\AppData\Local\Temp\B2F4.tmp"120⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\B391.tmp"C:\Users\Admin\AppData\Local\Temp\B391.tmp"121⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\B42D.tmp"C:\Users\Admin\AppData\Local\Temp\B42D.tmp"122⤵PID:3424
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-