Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230824-en -
resource tags
arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system -
submitted
30-08-2023 19:12
Static task
static1
Behavioral task
behavioral1
Sample
eccb888479fe887fe8d16cee36346166_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
eccb888479fe887fe8d16cee36346166_mafia_JC.exe
Resource
win10v2004-20230824-en
General
-
Target
eccb888479fe887fe8d16cee36346166_mafia_JC.exe
-
Size
520KB
-
MD5
eccb888479fe887fe8d16cee36346166
-
SHA1
286e7c8516d1eed7539cf7fa5a9619d7e79b972e
-
SHA256
7dbcdce07c2f130eb688e7e37924ac518b395ea80ff572d53dd9e2d61d3a14c9
-
SHA512
885873ee315ce221a68efaa445944078a9dd26357c608e8f39bd51dca91a41b294e995269f383e86db037a8c57516a54e141bc312efeaa88651e59bd3150b3a0
-
SSDEEP
12288:roRXOQjmOyeu8V+PEHW0gA3iqaQdyNOlc0tikQNZ:rogQ9yevVmE20gEiqBfLRQN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4796 49.tmp 4432 21E.tmp 1864 328.tmp 5016 402.tmp 656 4DD.tmp 2216 56A.tmp 4168 6D1.tmp 2660 77D.tmp 4068 848.tmp 4032 932.tmp 672 9DE.tmp 1708 A7B.tmp 4064 B36.tmp 2252 BD2.tmp 4464 C5F.tmp 4592 D59.tmp 2256 DE6.tmp 1372 E91.tmp 4116 FE9.tmp 4888 1112.tmp 440 11CE.tmp 2408 1373.tmp 3984 144E.tmp 3216 15E4.tmp 1556 1690.tmp 4228 175B.tmp 3472 1940.tmp 1900 19BD.tmp 4112 1A69.tmp 4268 1B53.tmp 4784 1C0F.tmp 2644 1C8C.tmp 1620 1D95.tmp 228 1E9F.tmp 2916 1F6A.tmp 4316 2006.tmp 5068 2083.tmp 3628 2110.tmp 3568 2268.tmp 2400 22E5.tmp 4080 2371.tmp 3372 240D.tmp 3440 24B9.tmp 1244 2527.tmp 948 25B3.tmp 4928 2621.tmp 1136 26BD.tmp 880 2759.tmp 2228 27F5.tmp 4896 28A1.tmp 4340 297C.tmp 5116 29F9.tmp 2172 2A86.tmp 4668 2B03.tmp 3888 2BDD.tmp 1776 2C4B.tmp 4628 2D06.tmp 3192 2D93.tmp 4076 2E00.tmp 408 2F29.tmp 736 2FA6.tmp 3708 3091.tmp 2724 30FE.tmp 672 319A.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{21D3467F-B35A-471B-BCD9-11E98A4EF81C}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3088 wrote to memory of 4796 3088 eccb888479fe887fe8d16cee36346166_mafia_JC.exe 85 PID 3088 wrote to memory of 4796 3088 eccb888479fe887fe8d16cee36346166_mafia_JC.exe 85 PID 3088 wrote to memory of 4796 3088 eccb888479fe887fe8d16cee36346166_mafia_JC.exe 85 PID 4796 wrote to memory of 4432 4796 49.tmp 86 PID 4796 wrote to memory of 4432 4796 49.tmp 86 PID 4796 wrote to memory of 4432 4796 49.tmp 86 PID 4432 wrote to memory of 1864 4432 21E.tmp 87 PID 4432 wrote to memory of 1864 4432 21E.tmp 87 PID 4432 wrote to memory of 1864 4432 21E.tmp 87 PID 1864 wrote to memory of 5016 1864 328.tmp 89 PID 1864 wrote to memory of 5016 1864 328.tmp 89 PID 1864 wrote to memory of 5016 1864 328.tmp 89 PID 5016 wrote to memory of 656 5016 402.tmp 90 PID 5016 wrote to memory of 656 5016 402.tmp 90 PID 5016 wrote to memory of 656 5016 402.tmp 90 PID 656 wrote to memory of 2216 656 4DD.tmp 91 PID 656 wrote to memory of 2216 656 4DD.tmp 91 PID 656 wrote to memory of 2216 656 4DD.tmp 91 PID 2216 wrote to memory of 4168 2216 56A.tmp 92 PID 2216 wrote to memory of 4168 2216 56A.tmp 92 PID 2216 wrote to memory of 4168 2216 56A.tmp 92 PID 4168 wrote to memory of 2660 4168 6D1.tmp 93 PID 4168 wrote to memory of 2660 4168 6D1.tmp 93 PID 4168 wrote to memory of 2660 4168 6D1.tmp 93 PID 2660 wrote to memory of 4068 2660 77D.tmp 94 PID 2660 wrote to memory of 4068 2660 77D.tmp 94 PID 2660 wrote to memory of 4068 2660 77D.tmp 94 PID 4068 wrote to memory of 4032 4068 848.tmp 95 PID 4068 wrote to memory of 4032 4068 848.tmp 95 PID 4068 wrote to memory of 4032 4068 848.tmp 95 PID 4032 wrote to memory of 672 4032 932.tmp 97 PID 4032 wrote to memory of 672 4032 932.tmp 97 PID 4032 wrote to memory of 672 4032 932.tmp 97 PID 672 wrote to memory of 1708 672 9DE.tmp 98 PID 672 wrote to memory of 1708 672 9DE.tmp 98 PID 672 wrote to memory of 1708 672 9DE.tmp 98 PID 1708 wrote to memory of 4064 1708 A7B.tmp 99 PID 1708 wrote to memory of 4064 1708 A7B.tmp 99 PID 1708 wrote to memory of 4064 1708 A7B.tmp 99 PID 4064 wrote to memory of 2252 4064 B36.tmp 100 PID 4064 wrote to memory of 2252 4064 B36.tmp 100 PID 4064 wrote to memory of 2252 4064 B36.tmp 100 PID 2252 wrote to memory of 4464 2252 BD2.tmp 101 PID 2252 wrote to memory of 4464 2252 BD2.tmp 101 PID 2252 wrote to memory of 4464 2252 BD2.tmp 101 PID 4464 wrote to memory of 4592 4464 C5F.tmp 102 PID 4464 wrote to memory of 4592 4464 C5F.tmp 102 PID 4464 wrote to memory of 4592 4464 C5F.tmp 102 PID 4592 wrote to memory of 2256 4592 D59.tmp 103 PID 4592 wrote to memory of 2256 4592 D59.tmp 103 PID 4592 wrote to memory of 2256 4592 D59.tmp 103 PID 2256 wrote to memory of 1372 2256 DE6.tmp 104 PID 2256 wrote to memory of 1372 2256 DE6.tmp 104 PID 2256 wrote to memory of 1372 2256 DE6.tmp 104 PID 1372 wrote to memory of 4116 1372 E91.tmp 105 PID 1372 wrote to memory of 4116 1372 E91.tmp 105 PID 1372 wrote to memory of 4116 1372 E91.tmp 105 PID 4116 wrote to memory of 4888 4116 FE9.tmp 106 PID 4116 wrote to memory of 4888 4116 FE9.tmp 106 PID 4116 wrote to memory of 4888 4116 FE9.tmp 106 PID 4888 wrote to memory of 440 4888 1112.tmp 107 PID 4888 wrote to memory of 440 4888 1112.tmp 107 PID 4888 wrote to memory of 440 4888 1112.tmp 107 PID 440 wrote to memory of 2408 440 11CE.tmp 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\eccb888479fe887fe8d16cee36346166_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\eccb888479fe887fe8d16cee36346166_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\49.tmp"C:\Users\Admin\AppData\Local\Temp\49.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Users\Admin\AppData\Local\Temp\21E.tmp"C:\Users\Admin\AppData\Local\Temp\21E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\328.tmp"C:\Users\Admin\AppData\Local\Temp\328.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\402.tmp"C:\Users\Admin\AppData\Local\Temp\402.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\56A.tmp"C:\Users\Admin\AppData\Local\Temp\56A.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\6D1.tmp"C:\Users\Admin\AppData\Local\Temp\6D1.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Users\Admin\AppData\Local\Temp\77D.tmp"C:\Users\Admin\AppData\Local\Temp\77D.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Users\Admin\AppData\Local\Temp\848.tmp"C:\Users\Admin\AppData\Local\Temp\848.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Users\Admin\AppData\Local\Temp\932.tmp"C:\Users\Admin\AppData\Local\Temp\932.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\A7B.tmp"C:\Users\Admin\AppData\Local\Temp\A7B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\BD2.tmp"C:\Users\Admin\AppData\Local\Temp\BD2.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\C5F.tmp"C:\Users\Admin\AppData\Local\Temp\C5F.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\D59.tmp"C:\Users\Admin\AppData\Local\Temp\D59.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\DE6.tmp"C:\Users\Admin\AppData\Local\Temp\DE6.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\FE9.tmp"C:\Users\Admin\AppData\Local\Temp\FE9.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\1112.tmp"C:\Users\Admin\AppData\Local\Temp\1112.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\AppData\Local\Temp\11CE.tmp"C:\Users\Admin\AppData\Local\Temp\11CE.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"23⤵
- Executes dropped EXE
PID:2408 -
C:\Users\Admin\AppData\Local\Temp\144E.tmp"C:\Users\Admin\AppData\Local\Temp\144E.tmp"24⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\15E4.tmp"C:\Users\Admin\AppData\Local\Temp\15E4.tmp"25⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\1690.tmp"C:\Users\Admin\AppData\Local\Temp\1690.tmp"26⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\175B.tmp"C:\Users\Admin\AppData\Local\Temp\175B.tmp"27⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\1940.tmp"C:\Users\Admin\AppData\Local\Temp\1940.tmp"28⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\19BD.tmp"C:\Users\Admin\AppData\Local\Temp\19BD.tmp"29⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\1A69.tmp"C:\Users\Admin\AppData\Local\Temp\1A69.tmp"30⤵
- Executes dropped EXE
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\1B53.tmp"C:\Users\Admin\AppData\Local\Temp\1B53.tmp"31⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"C:\Users\Admin\AppData\Local\Temp\1C0F.tmp"32⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"C:\Users\Admin\AppData\Local\Temp\1C8C.tmp"33⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\1D95.tmp"C:\Users\Admin\AppData\Local\Temp\1D95.tmp"34⤵
- Executes dropped EXE
PID:1620 -
C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"C:\Users\Admin\AppData\Local\Temp\1E9F.tmp"35⤵
- Executes dropped EXE
PID:228 -
C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"C:\Users\Admin\AppData\Local\Temp\1F6A.tmp"36⤵
- Executes dropped EXE
PID:2916 -
C:\Users\Admin\AppData\Local\Temp\2006.tmp"C:\Users\Admin\AppData\Local\Temp\2006.tmp"37⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2083.tmp"C:\Users\Admin\AppData\Local\Temp\2083.tmp"38⤵
- Executes dropped EXE
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\2110.tmp"C:\Users\Admin\AppData\Local\Temp\2110.tmp"39⤵
- Executes dropped EXE
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\2268.tmp"C:\Users\Admin\AppData\Local\Temp\2268.tmp"40⤵
- Executes dropped EXE
PID:3568 -
C:\Users\Admin\AppData\Local\Temp\22E5.tmp"C:\Users\Admin\AppData\Local\Temp\22E5.tmp"41⤵
- Executes dropped EXE
PID:2400 -
C:\Users\Admin\AppData\Local\Temp\2371.tmp"C:\Users\Admin\AppData\Local\Temp\2371.tmp"42⤵
- Executes dropped EXE
PID:4080 -
C:\Users\Admin\AppData\Local\Temp\240D.tmp"C:\Users\Admin\AppData\Local\Temp\240D.tmp"43⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\24B9.tmp"C:\Users\Admin\AppData\Local\Temp\24B9.tmp"44⤵
- Executes dropped EXE
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\2527.tmp"C:\Users\Admin\AppData\Local\Temp\2527.tmp"45⤵
- Executes dropped EXE
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\25B3.tmp"C:\Users\Admin\AppData\Local\Temp\25B3.tmp"46⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\2621.tmp"C:\Users\Admin\AppData\Local\Temp\2621.tmp"47⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\26BD.tmp"C:\Users\Admin\AppData\Local\Temp\26BD.tmp"48⤵
- Executes dropped EXE
PID:1136 -
C:\Users\Admin\AppData\Local\Temp\2759.tmp"C:\Users\Admin\AppData\Local\Temp\2759.tmp"49⤵
- Executes dropped EXE
PID:880 -
C:\Users\Admin\AppData\Local\Temp\27F5.tmp"C:\Users\Admin\AppData\Local\Temp\27F5.tmp"50⤵
- Executes dropped EXE
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\28A1.tmp"C:\Users\Admin\AppData\Local\Temp\28A1.tmp"51⤵
- Executes dropped EXE
PID:4896 -
C:\Users\Admin\AppData\Local\Temp\297C.tmp"C:\Users\Admin\AppData\Local\Temp\297C.tmp"52⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\29F9.tmp"C:\Users\Admin\AppData\Local\Temp\29F9.tmp"53⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\2A86.tmp"C:\Users\Admin\AppData\Local\Temp\2A86.tmp"54⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"55⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"C:\Users\Admin\AppData\Local\Temp\2BDD.tmp"56⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"57⤵
- Executes dropped EXE
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\2D06.tmp"C:\Users\Admin\AppData\Local\Temp\2D06.tmp"58⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\2D93.tmp"C:\Users\Admin\AppData\Local\Temp\2D93.tmp"59⤵
- Executes dropped EXE
PID:3192 -
C:\Users\Admin\AppData\Local\Temp\2E00.tmp"C:\Users\Admin\AppData\Local\Temp\2E00.tmp"60⤵
- Executes dropped EXE
PID:4076 -
C:\Users\Admin\AppData\Local\Temp\2F29.tmp"C:\Users\Admin\AppData\Local\Temp\2F29.tmp"61⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"62⤵
- Executes dropped EXE
PID:736 -
C:\Users\Admin\AppData\Local\Temp\3091.tmp"C:\Users\Admin\AppData\Local\Temp\3091.tmp"63⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\30FE.tmp"C:\Users\Admin\AppData\Local\Temp\30FE.tmp"64⤵
- Executes dropped EXE
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\319A.tmp"C:\Users\Admin\AppData\Local\Temp\319A.tmp"65⤵
- Executes dropped EXE
PID:672 -
C:\Users\Admin\AppData\Local\Temp\3285.tmp"C:\Users\Admin\AppData\Local\Temp\3285.tmp"66⤵PID:2736
-
C:\Users\Admin\AppData\Local\Temp\3321.tmp"C:\Users\Admin\AppData\Local\Temp\3321.tmp"67⤵PID:1352
-
C:\Users\Admin\AppData\Local\Temp\33BD.tmp"C:\Users\Admin\AppData\Local\Temp\33BD.tmp"68⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"69⤵PID:1444
-
C:\Users\Admin\AppData\Local\Temp\34E6.tmp"C:\Users\Admin\AppData\Local\Temp\34E6.tmp"70⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\3582.tmp"C:\Users\Admin\AppData\Local\Temp\3582.tmp"71⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\35FF.tmp"C:\Users\Admin\AppData\Local\Temp\35FF.tmp"72⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\369B.tmp"C:\Users\Admin\AppData\Local\Temp\369B.tmp"73⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\3728.tmp"C:\Users\Admin\AppData\Local\Temp\3728.tmp"74⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\37B5.tmp"C:\Users\Admin\AppData\Local\Temp\37B5.tmp"75⤵PID:3912
-
C:\Users\Admin\AppData\Local\Temp\3861.tmp"C:\Users\Admin\AppData\Local\Temp\3861.tmp"76⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\38ED.tmp"C:\Users\Admin\AppData\Local\Temp\38ED.tmp"77⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\397A.tmp"C:\Users\Admin\AppData\Local\Temp\397A.tmp"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\3A16.tmp"C:\Users\Admin\AppData\Local\Temp\3A16.tmp"79⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"C:\Users\Admin\AppData\Local\Temp\3AA3.tmp"80⤵PID:2408
-
C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"C:\Users\Admin\AppData\Local\Temp\3B2F.tmp"81⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"82⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"83⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\3C97.tmp"C:\Users\Admin\AppData\Local\Temp\3C97.tmp"84⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"85⤵PID:1008
-
C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"C:\Users\Admin\AppData\Local\Temp\3DB0.tmp"86⤵PID:3312
-
C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"C:\Users\Admin\AppData\Local\Temp\3E3D.tmp"87⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"C:\Users\Admin\AppData\Local\Temp\3EC9.tmp"88⤵PID:3472
-
C:\Users\Admin\AppData\Local\Temp\3F94.tmp"C:\Users\Admin\AppData\Local\Temp\3F94.tmp"89⤵PID:208
-
C:\Users\Admin\AppData\Local\Temp\4021.tmp"C:\Users\Admin\AppData\Local\Temp\4021.tmp"90⤵PID:4664
-
C:\Users\Admin\AppData\Local\Temp\409E.tmp"C:\Users\Admin\AppData\Local\Temp\409E.tmp"91⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\413A.tmp"C:\Users\Admin\AppData\Local\Temp\413A.tmp"92⤵PID:1420
-
C:\Users\Admin\AppData\Local\Temp\41B7.tmp"C:\Users\Admin\AppData\Local\Temp\41B7.tmp"93⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\4244.tmp"C:\Users\Admin\AppData\Local\Temp\4244.tmp"94⤵PID:1060
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"95⤵PID:2644
-
C:\Users\Admin\AppData\Local\Temp\438C.tmp"C:\Users\Admin\AppData\Local\Temp\438C.tmp"96⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\4409.tmp"C:\Users\Admin\AppData\Local\Temp\4409.tmp"97⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\4496.tmp"C:\Users\Admin\AppData\Local\Temp\4496.tmp"98⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\4503.tmp"C:\Users\Admin\AppData\Local\Temp\4503.tmp"99⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"100⤵PID:5068
-
C:\Users\Admin\AppData\Local\Temp\47F1.tmp"C:\Users\Admin\AppData\Local\Temp\47F1.tmp"101⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\485E.tmp"C:\Users\Admin\AppData\Local\Temp\485E.tmp"102⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\48FB.tmp"C:\Users\Admin\AppData\Local\Temp\48FB.tmp"103⤵PID:2400
-
C:\Users\Admin\AppData\Local\Temp\49A6.tmp"C:\Users\Admin\AppData\Local\Temp\49A6.tmp"104⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\4A52.tmp"C:\Users\Admin\AppData\Local\Temp\4A52.tmp"105⤵PID:3372
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"106⤵PID:3440
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"107⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\4C08.tmp"C:\Users\Admin\AppData\Local\Temp\4C08.tmp"108⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\4C94.tmp"C:\Users\Admin\AppData\Local\Temp\4C94.tmp"109⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\4D21.tmp"C:\Users\Admin\AppData\Local\Temp\4D21.tmp"110⤵PID:3392
-
C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"C:\Users\Admin\AppData\Local\Temp\4D8E.tmp"111⤵PID:1092
-
C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"C:\Users\Admin\AppData\Local\Temp\4E1B.tmp"112⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\4E88.tmp"C:\Users\Admin\AppData\Local\Temp\4E88.tmp"113⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"114⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\4F82.tmp"C:\Users\Admin\AppData\Local\Temp\4F82.tmp"115⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\500F.tmp"C:\Users\Admin\AppData\Local\Temp\500F.tmp"116⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\508C.tmp"C:\Users\Admin\AppData\Local\Temp\508C.tmp"117⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\5128.tmp"C:\Users\Admin\AppData\Local\Temp\5128.tmp"118⤵PID:1632
-
C:\Users\Admin\AppData\Local\Temp\51B5.tmp"C:\Users\Admin\AppData\Local\Temp\51B5.tmp"119⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\5251.tmp"C:\Users\Admin\AppData\Local\Temp\5251.tmp"120⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\52ED.tmp"C:\Users\Admin\AppData\Local\Temp\52ED.tmp"121⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\538A.tmp"C:\Users\Admin\AppData\Local\Temp\538A.tmp"122⤵PID:2272
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-