Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2023, 19:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe
Resource
win7-20230831-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe
Resource
win10v2004-20230915-en
3 signatures
150 seconds
General
-
Target
2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe
-
Size
486KB
-
MD5
5741ff029021ec6a6e55473c25d08ca7
-
SHA1
695886fb66c53811fe8a01ef1731a7725b1a3239
-
SHA256
b9819b96cc1bc97ff99fed47c04810feea6bf61b2fbc68eb85cf01ff9c7f3041
-
SHA512
d21b86f6065438d9d4f7741c067fd16ad9646a34366fd62e0480193494750d57266dd8af5ea97994ea24de1aaacf3ce6a2c57be1f27fd4943b3d241a44a81f9d
-
SSDEEP
12288:oU5rCOTeiDLL76JD24V8kn6+fvSaLgNZ:oUQOJDLH6Ja4Wkp67N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 840 7F71.tmp 4320 800D.tmp 1248 80B9.tmp 2664 81B3.tmp 400 825F.tmp 1056 83A7.tmp 4960 84B1.tmp 220 854D.tmp 2340 8628.tmp 1016 86D3.tmp 5052 878F.tmp 4932 880C.tmp 3608 88D7.tmp 5024 8964.tmp 5032 8C71.tmp 1828 8CFE.tmp 4372 8D8A.tmp 3000 8E26.tmp 1516 8EA3.tmp 4976 8F40.tmp 1564 8FBD.tmp 5000 9049.tmp 632 90F5.tmp 1924 9182.tmp 2480 922E.tmp 4696 92DA.tmp 1752 9376.tmp 404 9412.tmp 4320 9645.tmp 5016 96E1.tmp 4488 978D.tmp 1736 9839.tmp 1852 98C5.tmp 116 9952.tmp 4272 9A7B.tmp 3484 9AE8.tmp 736 9B84.tmp 2616 9C21.tmp 4028 9C9E.tmp 3656 9D2A.tmp 4764 9E34.tmp 2228 9EB1.tmp 3536 9FBA.tmp 3904 A037.tmp 2708 A0A5.tmp 5024 A131.tmp 4380 A1BE.tmp 1684 A24B.tmp 1624 A306.tmp 924 A383.tmp 928 A3F1.tmp 4108 A44E.tmp 2020 A4CB.tmp 4256 A558.tmp 2532 A5F4.tmp 4636 A681.tmp 1592 A70D.tmp 4424 A7AA.tmp 3156 A836.tmp 2648 A8B3.tmp 2696 A921.tmp 2032 A9CD.tmp 4696 AD09.tmp 800 AD76.tmp -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeManageVolumePrivilege 2972 svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3576 wrote to memory of 840 3576 2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe 82 PID 3576 wrote to memory of 840 3576 2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe 82 PID 3576 wrote to memory of 840 3576 2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe 82 PID 840 wrote to memory of 4320 840 7F71.tmp 84 PID 840 wrote to memory of 4320 840 7F71.tmp 84 PID 840 wrote to memory of 4320 840 7F71.tmp 84 PID 4320 wrote to memory of 1248 4320 800D.tmp 85 PID 4320 wrote to memory of 1248 4320 800D.tmp 85 PID 4320 wrote to memory of 1248 4320 800D.tmp 85 PID 1248 wrote to memory of 2664 1248 80B9.tmp 86 PID 1248 wrote to memory of 2664 1248 80B9.tmp 86 PID 1248 wrote to memory of 2664 1248 80B9.tmp 86 PID 2664 wrote to memory of 400 2664 81B3.tmp 87 PID 2664 wrote to memory of 400 2664 81B3.tmp 87 PID 2664 wrote to memory of 400 2664 81B3.tmp 87 PID 400 wrote to memory of 1056 400 825F.tmp 89 PID 400 wrote to memory of 1056 400 825F.tmp 89 PID 400 wrote to memory of 1056 400 825F.tmp 89 PID 1056 wrote to memory of 4960 1056 83A7.tmp 92 PID 1056 wrote to memory of 4960 1056 83A7.tmp 92 PID 1056 wrote to memory of 4960 1056 83A7.tmp 92 PID 4960 wrote to memory of 220 4960 84B1.tmp 93 PID 4960 wrote to memory of 220 4960 84B1.tmp 93 PID 4960 wrote to memory of 220 4960 84B1.tmp 93 PID 220 wrote to memory of 2340 220 854D.tmp 95 PID 220 wrote to memory of 2340 220 854D.tmp 95 PID 220 wrote to memory of 2340 220 854D.tmp 95 PID 2340 wrote to memory of 1016 2340 8628.tmp 96 PID 2340 wrote to memory of 1016 2340 8628.tmp 96 PID 2340 wrote to memory of 1016 2340 8628.tmp 96 PID 1016 wrote to memory of 5052 1016 86D3.tmp 97 PID 1016 wrote to memory of 5052 1016 86D3.tmp 97 PID 1016 wrote to memory of 5052 1016 86D3.tmp 97 PID 5052 wrote to memory of 4932 5052 878F.tmp 98 PID 5052 wrote to memory of 4932 5052 878F.tmp 98 PID 5052 wrote to memory of 4932 5052 878F.tmp 98 PID 4932 wrote to memory of 3608 4932 880C.tmp 99 PID 4932 wrote to memory of 3608 4932 880C.tmp 99 PID 4932 wrote to memory of 3608 4932 880C.tmp 99 PID 3608 wrote to memory of 5024 3608 88D7.tmp 100 PID 3608 wrote to memory of 5024 3608 88D7.tmp 100 PID 3608 wrote to memory of 5024 3608 88D7.tmp 100 PID 5024 wrote to memory of 5032 5024 8964.tmp 101 PID 5024 wrote to memory of 5032 5024 8964.tmp 101 PID 5024 wrote to memory of 5032 5024 8964.tmp 101 PID 5032 wrote to memory of 1828 5032 8C71.tmp 102 PID 5032 wrote to memory of 1828 5032 8C71.tmp 102 PID 5032 wrote to memory of 1828 5032 8C71.tmp 102 PID 1828 wrote to memory of 4372 1828 8CFE.tmp 105 PID 1828 wrote to memory of 4372 1828 8CFE.tmp 105 PID 1828 wrote to memory of 4372 1828 8CFE.tmp 105 PID 4372 wrote to memory of 3000 4372 8D8A.tmp 106 PID 4372 wrote to memory of 3000 4372 8D8A.tmp 106 PID 4372 wrote to memory of 3000 4372 8D8A.tmp 106 PID 3000 wrote to memory of 1516 3000 8E26.tmp 107 PID 3000 wrote to memory of 1516 3000 8E26.tmp 107 PID 3000 wrote to memory of 1516 3000 8E26.tmp 107 PID 1516 wrote to memory of 4976 1516 8EA3.tmp 108 PID 1516 wrote to memory of 4976 1516 8EA3.tmp 108 PID 1516 wrote to memory of 4976 1516 8EA3.tmp 108 PID 4976 wrote to memory of 1564 4976 8F40.tmp 109 PID 4976 wrote to memory of 1564 4976 8F40.tmp 109 PID 4976 wrote to memory of 1564 4976 8F40.tmp 109 PID 1564 wrote to memory of 5000 1564 8FBD.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-27_5741ff029021ec6a6e55473c25d08ca7_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Users\Admin\AppData\Local\Temp\800D.tmp"C:\Users\Admin\AppData\Local\Temp\800D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\80B9.tmp"C:\Users\Admin\AppData\Local\Temp\80B9.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\81B3.tmp"C:\Users\Admin\AppData\Local\Temp\81B3.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\825F.tmp"C:\Users\Admin\AppData\Local\Temp\825F.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\83A7.tmp"C:\Users\Admin\AppData\Local\Temp\83A7.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1056 -
C:\Users\Admin\AppData\Local\Temp\84B1.tmp"C:\Users\Admin\AppData\Local\Temp\84B1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:220 -
C:\Users\Admin\AppData\Local\Temp\8628.tmp"C:\Users\Admin\AppData\Local\Temp\8628.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\86D3.tmp"C:\Users\Admin\AppData\Local\Temp\86D3.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\878F.tmp"C:\Users\Admin\AppData\Local\Temp\878F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5052 -
C:\Users\Admin\AppData\Local\Temp\880C.tmp"C:\Users\Admin\AppData\Local\Temp\880C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\88D7.tmp"C:\Users\Admin\AppData\Local\Temp\88D7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3608 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\8C71.tmp"C:\Users\Admin\AppData\Local\Temp\8C71.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"C:\Users\Admin\AppData\Local\Temp\8CFE.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"C:\Users\Admin\AppData\Local\Temp\8D8A.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\8E26.tmp"C:\Users\Admin\AppData\Local\Temp\8E26.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\8F40.tmp"C:\Users\Admin\AppData\Local\Temp\8F40.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"C:\Users\Admin\AppData\Local\Temp\8FBD.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"23⤵
- Executes dropped EXE
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"24⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\9182.tmp"C:\Users\Admin\AppData\Local\Temp\9182.tmp"25⤵
- Executes dropped EXE
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\922E.tmp"C:\Users\Admin\AppData\Local\Temp\922E.tmp"26⤵
- Executes dropped EXE
PID:2480 -
C:\Users\Admin\AppData\Local\Temp\92DA.tmp"C:\Users\Admin\AppData\Local\Temp\92DA.tmp"27⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"28⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\9412.tmp"C:\Users\Admin\AppData\Local\Temp\9412.tmp"29⤵
- Executes dropped EXE
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"30⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"31⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\978D.tmp"C:\Users\Admin\AppData\Local\Temp\978D.tmp"32⤵
- Executes dropped EXE
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"33⤵
- Executes dropped EXE
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\98C5.tmp"C:\Users\Admin\AppData\Local\Temp\98C5.tmp"34⤵
- Executes dropped EXE
PID:1852 -
C:\Users\Admin\AppData\Local\Temp\9952.tmp"C:\Users\Admin\AppData\Local\Temp\9952.tmp"35⤵
- Executes dropped EXE
PID:116 -
C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"C:\Users\Admin\AppData\Local\Temp\9A7B.tmp"36⤵
- Executes dropped EXE
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"37⤵
- Executes dropped EXE
PID:3484 -
C:\Users\Admin\AppData\Local\Temp\9B84.tmp"C:\Users\Admin\AppData\Local\Temp\9B84.tmp"38⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\9C21.tmp"C:\Users\Admin\AppData\Local\Temp\9C21.tmp"39⤵
- Executes dropped EXE
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"C:\Users\Admin\AppData\Local\Temp\9C9E.tmp"40⤵
- Executes dropped EXE
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"41⤵
- Executes dropped EXE
PID:3656 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"42⤵
- Executes dropped EXE
PID:4764 -
C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"C:\Users\Admin\AppData\Local\Temp\9EB1.tmp"43⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"C:\Users\Admin\AppData\Local\Temp\9FBA.tmp"44⤵
- Executes dropped EXE
PID:3536 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"45⤵
- Executes dropped EXE
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"46⤵
- Executes dropped EXE
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\A131.tmp"C:\Users\Admin\AppData\Local\Temp\A131.tmp"47⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"48⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"49⤵
- Executes dropped EXE
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\A306.tmp"C:\Users\Admin\AppData\Local\Temp\A306.tmp"50⤵
- Executes dropped EXE
PID:1624 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"51⤵
- Executes dropped EXE
PID:924 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"52⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\A44E.tmp"C:\Users\Admin\AppData\Local\Temp\A44E.tmp"53⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"54⤵
- Executes dropped EXE
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"55⤵
- Executes dropped EXE
PID:4256 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"56⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"57⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A70D.tmp"C:\Users\Admin\AppData\Local\Temp\A70D.tmp"58⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"C:\Users\Admin\AppData\Local\Temp\A7AA.tmp"59⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\A836.tmp"C:\Users\Admin\AppData\Local\Temp\A836.tmp"60⤵
- Executes dropped EXE
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"C:\Users\Admin\AppData\Local\Temp\A8B3.tmp"61⤵
- Executes dropped EXE
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"62⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"C:\Users\Admin\AppData\Local\Temp\A9CD.tmp"63⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"64⤵
- Executes dropped EXE
PID:4696 -
C:\Users\Admin\AppData\Local\Temp\AD76.tmp"C:\Users\Admin\AppData\Local\Temp\AD76.tmp"65⤵
- Executes dropped EXE
PID:800 -
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"66⤵PID:3184
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"67⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"68⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\AF89.tmp"C:\Users\Admin\AppData\Local\Temp\AF89.tmp"69⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\B016.tmp"C:\Users\Admin\AppData\Local\Temp\B016.tmp"70⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\B083.tmp"C:\Users\Admin\AppData\Local\Temp\B083.tmp"71⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"C:\Users\Admin\AppData\Local\Temp\B0F1.tmp"72⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"73⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"C:\Users\Admin\AppData\Local\Temp\B1CB.tmp"74⤵PID:1872
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"75⤵PID:4812
-
C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"C:\Users\Admin\AppData\Local\Temp\B2A6.tmp"76⤵PID:756
-
C:\Users\Admin\AppData\Local\Temp\B314.tmp"C:\Users\Admin\AppData\Local\Temp\B314.tmp"77⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"78⤵PID:1052
-
C:\Users\Admin\AppData\Local\Temp\B49A.tmp"C:\Users\Admin\AppData\Local\Temp\B49A.tmp"79⤵PID:5084
-
C:\Users\Admin\AppData\Local\Temp\B556.tmp"C:\Users\Admin\AppData\Local\Temp\B556.tmp"80⤵PID:2136
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"81⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"82⤵PID:3332
-
C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"C:\Users\Admin\AppData\Local\Temp\B6FC.tmp"83⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7B7.tmp"84⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"85⤵PID:2452
-
C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"C:\Users\Admin\AppData\Local\Temp\B8E0.tmp"86⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"87⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\BA09.tmp"C:\Users\Admin\AppData\Local\Temp\BA09.tmp"88⤵PID:3140
-
C:\Users\Admin\AppData\Local\Temp\BA67.tmp"C:\Users\Admin\AppData\Local\Temp\BA67.tmp"89⤵PID:1856
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"90⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"C:\Users\Admin\AppData\Local\Temp\BB8F.tmp"91⤵PID:2984
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"92⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"C:\Users\Admin\AppData\Local\Temp\BCC8.tmp"93⤵PID:1440
-
C:\Users\Admin\AppData\Local\Temp\BD45.tmp"C:\Users\Admin\AppData\Local\Temp\BD45.tmp"94⤵PID:2020
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"95⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"C:\Users\Admin\AppData\Local\Temp\BE5E.tmp"96⤵PID:2532
-
C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"C:\Users\Admin\AppData\Local\Temp\BEEB.tmp"97⤵PID:2912
-
C:\Users\Admin\AppData\Local\Temp\BF77.tmp"C:\Users\Admin\AppData\Local\Temp\BF77.tmp"98⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\C014.tmp"C:\Users\Admin\AppData\Local\Temp\C014.tmp"99⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\C091.tmp"C:\Users\Admin\AppData\Local\Temp\C091.tmp"100⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"C:\Users\Admin\AppData\Local\Temp\C0EE.tmp"101⤵PID:1096
-
C:\Users\Admin\AppData\Local\Temp\C15C.tmp"C:\Users\Admin\AppData\Local\Temp\C15C.tmp"102⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"103⤵PID:4628
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"104⤵PID:4456
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"105⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"106⤵PID:116
-
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"107⤵PID:4272
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"108⤵PID:3464
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"109⤵PID:2296
-
C:\Users\Admin\AppData\Local\Temp\C592.tmp"C:\Users\Admin\AppData\Local\Temp\C592.tmp"110⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\C62E.tmp"C:\Users\Admin\AppData\Local\Temp\C62E.tmp"111⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\C69C.tmp"C:\Users\Admin\AppData\Local\Temp\C69C.tmp"112⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\C719.tmp"C:\Users\Admin\AppData\Local\Temp\C719.tmp"113⤵PID:3892
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"114⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"115⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\C89F.tmp"C:\Users\Admin\AppData\Local\Temp\C89F.tmp"116⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\C91C.tmp"C:\Users\Admin\AppData\Local\Temp\C91C.tmp"117⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"C:\Users\Admin\AppData\Local\Temp\C9A9.tmp"118⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\CA26.tmp"C:\Users\Admin\AppData\Local\Temp\CA26.tmp"119⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"120⤵PID:3408
-
C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"C:\Users\Admin\AppData\Local\Temp\CB3F.tmp"121⤵PID:3904
-
C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"C:\Users\Admin\AppData\Local\Temp\CBCC.tmp"122⤵PID:1716
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-