Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 16:36
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe
-
Size
520KB
-
MD5
468d62b405f6e135ef1bd5b59b8bd364
-
SHA1
0245985326ece522811b7bf84f9a208aa0c315f6
-
SHA256
8a4373a047c4936ba86d2d6ca084cb981b390af565b4bc2219303ffdd1406313
-
SHA512
492a45fabfbb95e89486ef8cb0bd37ee14369fa12f21f846a1e9f45cd8c28c16e7617b4ef3c83d36fe1442bbdd6a9f3935593f28ce6b17a17419fd78e53b992b
-
SSDEEP
12288:roRXOQjmOyMBG9wyjdFSc5W3y778Zb0NZ:rogQ9yMBMwidF1aU7HN
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3936 86B4.tmp 2804 8A5E.tmp 3440 8AFA.tmp 2272 8BB5.tmp 3788 8C52.tmp 1084 8D0D.tmp 1680 8DB9.tmp 2572 8E65.tmp 912 8F11.tmp 1912 8F9D.tmp 4700 9078.tmp 4264 90F5.tmp 2964 91A1.tmp 3460 925D.tmp 2456 92E9.tmp 3140 93A5.tmp 4468 9451.tmp 4192 94DD.tmp 2640 9579.tmp 4620 9625.tmp 1808 96C2.tmp 4308 974E.tmp 2076 97DB.tmp 1628 98A6.tmp 3392 9961.tmp 4832 99DE.tmp 1640 9AB9.tmp 4504 9B46.tmp 4780 9BD2.tmp 4724 9C5F.tmp 3832 9CDC.tmp 4120 9D88.tmp 3804 9E53.tmp 3708 9F2E.tmp 2348 9FAB.tmp 3924 A066.tmp 4892 A0B4.tmp 4636 A151.tmp 1652 A1DD.tmp 1880 A24B.tmp 4748 A2D7.tmp 2148 A345.tmp 4108 A3D1.tmp 4936 A43F.tmp 4052 A4AC.tmp 4952 A558.tmp 1140 A5F4.tmp 4132 A681.tmp 4372 A6FE.tmp 4552 A76B.tmp 4472 A7F8.tmp 4312 A875.tmp 1072 A8E2.tmp 3128 A96F.tmp 5092 A9FB.tmp 3532 AAA7.tmp 2036 AB44.tmp 1216 ABE0.tmp 2720 AC5D.tmp 4692 ACF9.tmp 3624 AD86.tmp 4948 AE03.tmp 3300 AE80.tmp 4512 AF0C.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0AB51EDC-825F-40CA-B9A7-027F3058D87C}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 336 wrote to memory of 3936 336 2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe 84 PID 336 wrote to memory of 3936 336 2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe 84 PID 336 wrote to memory of 3936 336 2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe 84 PID 3936 wrote to memory of 2804 3936 86B4.tmp 86 PID 3936 wrote to memory of 2804 3936 86B4.tmp 86 PID 3936 wrote to memory of 2804 3936 86B4.tmp 86 PID 2804 wrote to memory of 3440 2804 8A5E.tmp 87 PID 2804 wrote to memory of 3440 2804 8A5E.tmp 87 PID 2804 wrote to memory of 3440 2804 8A5E.tmp 87 PID 3440 wrote to memory of 2272 3440 8AFA.tmp 88 PID 3440 wrote to memory of 2272 3440 8AFA.tmp 88 PID 3440 wrote to memory of 2272 3440 8AFA.tmp 88 PID 2272 wrote to memory of 3788 2272 8BB5.tmp 89 PID 2272 wrote to memory of 3788 2272 8BB5.tmp 89 PID 2272 wrote to memory of 3788 2272 8BB5.tmp 89 PID 3788 wrote to memory of 1084 3788 8C52.tmp 90 PID 3788 wrote to memory of 1084 3788 8C52.tmp 90 PID 3788 wrote to memory of 1084 3788 8C52.tmp 90 PID 1084 wrote to memory of 1680 1084 8D0D.tmp 91 PID 1084 wrote to memory of 1680 1084 8D0D.tmp 91 PID 1084 wrote to memory of 1680 1084 8D0D.tmp 91 PID 1680 wrote to memory of 2572 1680 8DB9.tmp 92 PID 1680 wrote to memory of 2572 1680 8DB9.tmp 92 PID 1680 wrote to memory of 2572 1680 8DB9.tmp 92 PID 2572 wrote to memory of 912 2572 8E65.tmp 93 PID 2572 wrote to memory of 912 2572 8E65.tmp 93 PID 2572 wrote to memory of 912 2572 8E65.tmp 93 PID 912 wrote to memory of 1912 912 8F11.tmp 94 PID 912 wrote to memory of 1912 912 8F11.tmp 94 PID 912 wrote to memory of 1912 912 8F11.tmp 94 PID 1912 wrote to memory of 4700 1912 8F9D.tmp 95 PID 1912 wrote to memory of 4700 1912 8F9D.tmp 95 PID 1912 wrote to memory of 4700 1912 8F9D.tmp 95 PID 4700 wrote to memory of 4264 4700 9078.tmp 96 PID 4700 wrote to memory of 4264 4700 9078.tmp 96 PID 4700 wrote to memory of 4264 4700 9078.tmp 96 PID 4264 wrote to memory of 2964 4264 90F5.tmp 97 PID 4264 wrote to memory of 2964 4264 90F5.tmp 97 PID 4264 wrote to memory of 2964 4264 90F5.tmp 97 PID 2964 wrote to memory of 3460 2964 91A1.tmp 99 PID 2964 wrote to memory of 3460 2964 91A1.tmp 99 PID 2964 wrote to memory of 3460 2964 91A1.tmp 99 PID 3460 wrote to memory of 2456 3460 925D.tmp 100 PID 3460 wrote to memory of 2456 3460 925D.tmp 100 PID 3460 wrote to memory of 2456 3460 925D.tmp 100 PID 2456 wrote to memory of 3140 2456 92E9.tmp 101 PID 2456 wrote to memory of 3140 2456 92E9.tmp 101 PID 2456 wrote to memory of 3140 2456 92E9.tmp 101 PID 3140 wrote to memory of 4468 3140 93A5.tmp 103 PID 3140 wrote to memory of 4468 3140 93A5.tmp 103 PID 3140 wrote to memory of 4468 3140 93A5.tmp 103 PID 4468 wrote to memory of 4192 4468 9451.tmp 104 PID 4468 wrote to memory of 4192 4468 9451.tmp 104 PID 4468 wrote to memory of 4192 4468 9451.tmp 104 PID 4192 wrote to memory of 2640 4192 94DD.tmp 105 PID 4192 wrote to memory of 2640 4192 94DD.tmp 105 PID 4192 wrote to memory of 2640 4192 94DD.tmp 105 PID 2640 wrote to memory of 4620 2640 9579.tmp 106 PID 2640 wrote to memory of 4620 2640 9579.tmp 106 PID 2640 wrote to memory of 4620 2640 9579.tmp 106 PID 4620 wrote to memory of 1808 4620 9625.tmp 107 PID 4620 wrote to memory of 1808 4620 9625.tmp 107 PID 4620 wrote to memory of 1808 4620 9625.tmp 107 PID 1808 wrote to memory of 4308 1808 96C2.tmp 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_468d62b405f6e135ef1bd5b59b8bd364_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3936 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"C:\Users\Admin\AppData\Local\Temp\8AFA.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Local\Temp\8C52.tmp"C:\Users\Admin\AppData\Local\Temp\8C52.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"C:\Users\Admin\AppData\Local\Temp\8D0D.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1084 -
C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"C:\Users\Admin\AppData\Local\Temp\8DB9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\8F11.tmp"C:\Users\Admin\AppData\Local\Temp\8F11.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Users\Admin\AppData\Local\Temp\9078.tmp"C:\Users\Admin\AppData\Local\Temp\9078.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4264 -
C:\Users\Admin\AppData\Local\Temp\91A1.tmp"C:\Users\Admin\AppData\Local\Temp\91A1.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Users\Admin\AppData\Local\Temp\92E9.tmp"C:\Users\Admin\AppData\Local\Temp\92E9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Users\Admin\AppData\Local\Temp\9451.tmp"C:\Users\Admin\AppData\Local\Temp\9451.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Users\Admin\AppData\Local\Temp\94DD.tmp"C:\Users\Admin\AppData\Local\Temp\94DD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2640 -
C:\Users\Admin\AppData\Local\Temp\9625.tmp"C:\Users\Admin\AppData\Local\Temp\9625.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4620 -
C:\Users\Admin\AppData\Local\Temp\96C2.tmp"C:\Users\Admin\AppData\Local\Temp\96C2.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"23⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"24⤵
- Executes dropped EXE
PID:2076 -
C:\Users\Admin\AppData\Local\Temp\98A6.tmp"C:\Users\Admin\AppData\Local\Temp\98A6.tmp"25⤵
- Executes dropped EXE
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\9961.tmp"C:\Users\Admin\AppData\Local\Temp\9961.tmp"26⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\99DE.tmp"C:\Users\Admin\AppData\Local\Temp\99DE.tmp"27⤵
- Executes dropped EXE
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"C:\Users\Admin\AppData\Local\Temp\9AB9.tmp"28⤵
- Executes dropped EXE
PID:1640 -
C:\Users\Admin\AppData\Local\Temp\9B46.tmp"C:\Users\Admin\AppData\Local\Temp\9B46.tmp"29⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"C:\Users\Admin\AppData\Local\Temp\9BD2.tmp"30⤵
- Executes dropped EXE
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"C:\Users\Admin\AppData\Local\Temp\9C5F.tmp"31⤵
- Executes dropped EXE
PID:4724 -
C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"C:\Users\Admin\AppData\Local\Temp\9CDC.tmp"32⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"33⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\9E53.tmp"C:\Users\Admin\AppData\Local\Temp\9E53.tmp"34⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"C:\Users\Admin\AppData\Local\Temp\9F2E.tmp"35⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"36⤵
- Executes dropped EXE
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\A066.tmp"C:\Users\Admin\AppData\Local\Temp\A066.tmp"37⤵
- Executes dropped EXE
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"C:\Users\Admin\AppData\Local\Temp\A0B4.tmp"38⤵
- Executes dropped EXE
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"39⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"C:\Users\Admin\AppData\Local\Temp\A1DD.tmp"40⤵
- Executes dropped EXE
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"41⤵
- Executes dropped EXE
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"42⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"43⤵
- Executes dropped EXE
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"C:\Users\Admin\AppData\Local\Temp\A3D1.tmp"44⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"45⤵
- Executes dropped EXE
PID:4936 -
C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"C:\Users\Admin\AppData\Local\Temp\A4AC.tmp"46⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\A558.tmp"C:\Users\Admin\AppData\Local\Temp\A558.tmp"47⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"48⤵
- Executes dropped EXE
PID:1140 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"49⤵
- Executes dropped EXE
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"C:\Users\Admin\AppData\Local\Temp\A6FE.tmp"50⤵
- Executes dropped EXE
PID:4372 -
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"51⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"C:\Users\Admin\AppData\Local\Temp\A7F8.tmp"52⤵
- Executes dropped EXE
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"53⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"54⤵
- Executes dropped EXE
PID:1072 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"55⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"C:\Users\Admin\AppData\Local\Temp\A9FB.tmp"56⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"57⤵
- Executes dropped EXE
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\AB44.tmp"C:\Users\Admin\AppData\Local\Temp\AB44.tmp"58⤵
- Executes dropped EXE
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"C:\Users\Admin\AppData\Local\Temp\ABE0.tmp"59⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"C:\Users\Admin\AppData\Local\Temp\AC5D.tmp"60⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"61⤵
- Executes dropped EXE
PID:4692 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"62⤵
- Executes dropped EXE
PID:3624 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"63⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\AE80.tmp"C:\Users\Admin\AppData\Local\Temp\AE80.tmp"64⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"C:\Users\Admin\AppData\Local\Temp\AF0C.tmp"65⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"C:\Users\Admin\AppData\Local\Temp\AF7A.tmp"66⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\B006.tmp"C:\Users\Admin\AppData\Local\Temp\B006.tmp"67⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"68⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"69⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"70⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\B239.tmp"C:\Users\Admin\AppData\Local\Temp\B239.tmp"71⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"C:\Users\Admin\AppData\Local\Temp\B2B6.tmp"72⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\B333.tmp"C:\Users\Admin\AppData\Local\Temp\B333.tmp"73⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"C:\Users\Admin\AppData\Local\Temp\B3BF.tmp"74⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"75⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"76⤵PID:4104
-
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"77⤵PID:1928
-
C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"C:\Users\Admin\AppData\Local\Temp\B5D3.tmp"78⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"79⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"C:\Users\Admin\AppData\Local\Temp\B6DC.tmp"80⤵PID:2308
-
C:\Users\Admin\AppData\Local\Temp\B759.tmp"C:\Users\Admin\AppData\Local\Temp\B759.tmp"81⤵PID:4428
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"82⤵PID:3192
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"83⤵PID:2072
-
C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"C:\Users\Admin\AppData\Local\Temp\B8B1.tmp"84⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"85⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"C:\Users\Admin\AppData\Local\Temp\B9CA.tmp"86⤵PID:728
-
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"87⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"C:\Users\Admin\AppData\Local\Temp\BAD4.tmp"88⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\BB80.tmp"C:\Users\Admin\AppData\Local\Temp\BB80.tmp"89⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"90⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"91⤵PID:1236
-
C:\Users\Admin\AppData\Local\Temp\BD26.tmp"C:\Users\Admin\AppData\Local\Temp\BD26.tmp"92⤵PID:2204
-
C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"C:\Users\Admin\AppData\Local\Temp\BDB2.tmp"93⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\BE20.tmp"C:\Users\Admin\AppData\Local\Temp\BE20.tmp"94⤵PID:4928
-
C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"C:\Users\Admin\AppData\Local\Temp\BEAC.tmp"95⤵PID:228
-
C:\Users\Admin\AppData\Local\Temp\BF29.tmp"C:\Users\Admin\AppData\Local\Temp\BF29.tmp"96⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"97⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\C023.tmp"C:\Users\Admin\AppData\Local\Temp\C023.tmp"98⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"C:\Users\Admin\AppData\Local\Temp\C0B0.tmp"99⤵PID:4828
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"100⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"C:\Users\Admin\AppData\Local\Temp\C1AA.tmp"101⤵PID:1220
-
C:\Users\Admin\AppData\Local\Temp\C237.tmp"C:\Users\Admin\AppData\Local\Temp\C237.tmp"102⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"103⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\C36F.tmp"C:\Users\Admin\AppData\Local\Temp\C36F.tmp"104⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"C:\Users\Admin\AppData\Local\Temp\C3FC.tmp"105⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"106⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\C525.tmp"C:\Users\Admin\AppData\Local\Temp\C525.tmp"107⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"C:\Users\Admin\AppData\Local\Temp\C5B1.tmp"108⤵PID:2516
-
C:\Users\Admin\AppData\Local\Temp\C64D.tmp"C:\Users\Admin\AppData\Local\Temp\C64D.tmp"109⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"C:\Users\Admin\AppData\Local\Temp\C6CA.tmp"110⤵PID:4052
-
C:\Users\Admin\AppData\Local\Temp\C757.tmp"C:\Users\Admin\AppData\Local\Temp\C757.tmp"111⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"C:\Users\Admin\AppData\Local\Temp\C7E4.tmp"112⤵PID:3568
-
C:\Users\Admin\AppData\Local\Temp\C870.tmp"C:\Users\Admin\AppData\Local\Temp\C870.tmp"113⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"C:\Users\Admin\AppData\Local\Temp\C8FD.tmp"114⤵PID:1680
-
C:\Users\Admin\AppData\Local\Temp\CA35.tmp"C:\Users\Admin\AppData\Local\Temp\CA35.tmp"115⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"C:\Users\Admin\AppData\Local\Temp\CAB2.tmp"116⤵PID:4552
-
C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"C:\Users\Admin\AppData\Local\Temp\CB2F.tmp"117⤵PID:4472
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"118⤵PID:4312
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"119⤵PID:1072
-
C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"C:\Users\Admin\AppData\Local\Temp\CCA6.tmp"120⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"121⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"C:\Users\Admin\AppData\Local\Temp\CDC0.tmp"122⤵PID:3532
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-