Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
02/09/2023, 18:55
Static task
static1
Behavioral task
behavioral1
Sample
2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe
Resource
win10v2004-20230831-en
General
-
Target
2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe
-
Size
486KB
-
MD5
6447846788396250058f298542a36ca6
-
SHA1
edfa4da1e8346840a5ec0d9a552e0135a34cf543
-
SHA256
dc7c4b0b8ff0a591ebae3ca9c610aff3da04aeb4365f299b8653cc7474ebfbdd
-
SHA512
7ff9e938877f64881758a14129564922ad38248ecb9a955eaac17130f1988ba2325418263efcaf8773375fa27b36e56b61832202eb4616ec69f2fb5c328f5d4e
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7BDbeflYVrts4iSNMuqKVjYlWERLfNgGJHsHT:/U5rCOTeiDdbbBg9uNV00EJKGyNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1880 C2D3.tmp 3008 C498.tmp 2248 C515.tmp 4624 C5E0.tmp 3052 CF56.tmp 3188 D10B.tmp 4176 D1E6.tmp 4856 D2A2.tmp 3680 D34E.tmp 5000 D419.tmp 2332 D503.tmp 2112 D5BF.tmp 1960 D68A.tmp 4000 D755.tmp 2704 D801.tmp 4768 D8DB.tmp 400 DA33.tmp 4904 DB4C.tmp 4972 DC37.tmp 3740 DCC3.tmp 4128 DD60.tmp 2496 DE1B.tmp 496 DE89.tmp 4600 DF15.tmp 3736 DFB1.tmp 1732 E06D.tmp 4188 E138.tmp 3708 E203.tmp 3972 E2EE.tmp 4092 E399.tmp 3372 E493.tmp 2732 E53F.tmp 4960 E5DC.tmp 1236 E668.tmp 3276 E733.tmp 3744 E7B0.tmp 2520 E84D.tmp 2572 E8CA.tmp 3676 E937.tmp 4412 E9F2.tmp 4536 EA8F.tmp 2184 EB2B.tmp 2892 EBD7.tmp 2156 EC63.tmp 4568 ED1F.tmp 4332 EDBB.tmp 4604 EE29.tmp 972 F04B.tmp 1464 F194.tmp 2464 F25F.tmp 2852 F2FB.tmp 1152 F453.tmp 3172 F53D.tmp 1456 F608.tmp 704 F685.tmp 4700 F702.tmp 3472 F80C.tmp 1588 F898.tmp 3816 F944.tmp 1248 F9B2.tmp 3680 FA4E.tmp 3388 FAFA.tmp 3500 FBE4.tmp 2332 FCBF.tmp -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{F0C15773-4BC6-417C-909B-602124405852}.catalogItem svchost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3780 wrote to memory of 1880 3780 2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe 85 PID 3780 wrote to memory of 1880 3780 2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe 85 PID 3780 wrote to memory of 1880 3780 2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe 85 PID 1880 wrote to memory of 3008 1880 C2D3.tmp 86 PID 1880 wrote to memory of 3008 1880 C2D3.tmp 86 PID 1880 wrote to memory of 3008 1880 C2D3.tmp 86 PID 3008 wrote to memory of 2248 3008 C498.tmp 87 PID 3008 wrote to memory of 2248 3008 C498.tmp 87 PID 3008 wrote to memory of 2248 3008 C498.tmp 87 PID 2248 wrote to memory of 4624 2248 C515.tmp 88 PID 2248 wrote to memory of 4624 2248 C515.tmp 88 PID 2248 wrote to memory of 4624 2248 C515.tmp 88 PID 4624 wrote to memory of 3052 4624 C5E0.tmp 89 PID 4624 wrote to memory of 3052 4624 C5E0.tmp 89 PID 4624 wrote to memory of 3052 4624 C5E0.tmp 89 PID 3052 wrote to memory of 3188 3052 CF56.tmp 91 PID 3052 wrote to memory of 3188 3052 CF56.tmp 91 PID 3052 wrote to memory of 3188 3052 CF56.tmp 91 PID 3188 wrote to memory of 4176 3188 D10B.tmp 92 PID 3188 wrote to memory of 4176 3188 D10B.tmp 92 PID 3188 wrote to memory of 4176 3188 D10B.tmp 92 PID 4176 wrote to memory of 4856 4176 D1E6.tmp 93 PID 4176 wrote to memory of 4856 4176 D1E6.tmp 93 PID 4176 wrote to memory of 4856 4176 D1E6.tmp 93 PID 4856 wrote to memory of 3680 4856 D2A2.tmp 94 PID 4856 wrote to memory of 3680 4856 D2A2.tmp 94 PID 4856 wrote to memory of 3680 4856 D2A2.tmp 94 PID 3680 wrote to memory of 5000 3680 D34E.tmp 95 PID 3680 wrote to memory of 5000 3680 D34E.tmp 95 PID 3680 wrote to memory of 5000 3680 D34E.tmp 95 PID 5000 wrote to memory of 2332 5000 D419.tmp 96 PID 5000 wrote to memory of 2332 5000 D419.tmp 96 PID 5000 wrote to memory of 2332 5000 D419.tmp 96 PID 2332 wrote to memory of 2112 2332 D503.tmp 97 PID 2332 wrote to memory of 2112 2332 D503.tmp 97 PID 2332 wrote to memory of 2112 2332 D503.tmp 97 PID 2112 wrote to memory of 1960 2112 D5BF.tmp 99 PID 2112 wrote to memory of 1960 2112 D5BF.tmp 99 PID 2112 wrote to memory of 1960 2112 D5BF.tmp 99 PID 1960 wrote to memory of 4000 1960 D68A.tmp 100 PID 1960 wrote to memory of 4000 1960 D68A.tmp 100 PID 1960 wrote to memory of 4000 1960 D68A.tmp 100 PID 4000 wrote to memory of 2704 4000 D755.tmp 101 PID 4000 wrote to memory of 2704 4000 D755.tmp 101 PID 4000 wrote to memory of 2704 4000 D755.tmp 101 PID 2704 wrote to memory of 4768 2704 D801.tmp 102 PID 2704 wrote to memory of 4768 2704 D801.tmp 102 PID 2704 wrote to memory of 4768 2704 D801.tmp 102 PID 4768 wrote to memory of 400 4768 D8DB.tmp 103 PID 4768 wrote to memory of 400 4768 D8DB.tmp 103 PID 4768 wrote to memory of 400 4768 D8DB.tmp 103 PID 400 wrote to memory of 4904 400 DA33.tmp 104 PID 400 wrote to memory of 4904 400 DA33.tmp 104 PID 400 wrote to memory of 4904 400 DA33.tmp 104 PID 4904 wrote to memory of 4972 4904 DB4C.tmp 105 PID 4904 wrote to memory of 4972 4904 DB4C.tmp 105 PID 4904 wrote to memory of 4972 4904 DB4C.tmp 105 PID 4972 wrote to memory of 3740 4972 DC37.tmp 106 PID 4972 wrote to memory of 3740 4972 DC37.tmp 106 PID 4972 wrote to memory of 3740 4972 DC37.tmp 106 PID 3740 wrote to memory of 4128 3740 DCC3.tmp 107 PID 3740 wrote to memory of 4128 3740 DCC3.tmp 107 PID 3740 wrote to memory of 4128 3740 DCC3.tmp 107 PID 4128 wrote to memory of 2496 4128 DD60.tmp 108 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\2023-08-22_6447846788396250058f298542a36ca6_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"C:\Users\Admin\AppData\Local\Temp\C2D3.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"C:\Users\Admin\AppData\Local\Temp\C5E0.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\D10B.tmp"C:\Users\Admin\AppData\Local\Temp\D10B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"C:\Users\Admin\AppData\Local\Temp\D1E6.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4176 -
C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"C:\Users\Admin\AppData\Local\Temp\D2A2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\D419.tmp"C:\Users\Admin\AppData\Local\Temp\D419.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Users\Admin\AppData\Local\Temp\D503.tmp"C:\Users\Admin\AppData\Local\Temp\D503.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"C:\Users\Admin\AppData\Local\Temp\D5BF.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\D755.tmp"C:\Users\Admin\AppData\Local\Temp\D755.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\D801.tmp"C:\Users\Admin\AppData\Local\Temp\D801.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"C:\Users\Admin\AppData\Local\Temp\D8DB.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\DA33.tmp"C:\Users\Admin\AppData\Local\Temp\DA33.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"C:\Users\Admin\AppData\Local\Temp\DB4C.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"C:\Users\Admin\AppData\Local\Temp\DCC3.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\DD60.tmp"C:\Users\Admin\AppData\Local\Temp\DD60.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"C:\Users\Admin\AppData\Local\Temp\DE1B.tmp"23⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\DE89.tmp"C:\Users\Admin\AppData\Local\Temp\DE89.tmp"24⤵
- Executes dropped EXE
PID:496 -
C:\Users\Admin\AppData\Local\Temp\DF15.tmp"C:\Users\Admin\AppData\Local\Temp\DF15.tmp"25⤵
- Executes dropped EXE
PID:4600 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"26⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\E06D.tmp"C:\Users\Admin\AppData\Local\Temp\E06D.tmp"27⤵
- Executes dropped EXE
PID:1732 -
C:\Users\Admin\AppData\Local\Temp\E138.tmp"C:\Users\Admin\AppData\Local\Temp\E138.tmp"28⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\E203.tmp"C:\Users\Admin\AppData\Local\Temp\E203.tmp"29⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"C:\Users\Admin\AppData\Local\Temp\E2EE.tmp"30⤵
- Executes dropped EXE
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\E399.tmp"C:\Users\Admin\AppData\Local\Temp\E399.tmp"31⤵
- Executes dropped EXE
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\E493.tmp"C:\Users\Admin\AppData\Local\Temp\E493.tmp"32⤵
- Executes dropped EXE
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\E53F.tmp"C:\Users\Admin\AppData\Local\Temp\E53F.tmp"33⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"C:\Users\Admin\AppData\Local\Temp\E5DC.tmp"34⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\E668.tmp"C:\Users\Admin\AppData\Local\Temp\E668.tmp"35⤵
- Executes dropped EXE
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"36⤵
- Executes dropped EXE
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"37⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\E84D.tmp"C:\Users\Admin\AppData\Local\Temp\E84D.tmp"38⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"C:\Users\Admin\AppData\Local\Temp\E8CA.tmp"39⤵
- Executes dropped EXE
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\E937.tmp"C:\Users\Admin\AppData\Local\Temp\E937.tmp"40⤵
- Executes dropped EXE
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"C:\Users\Admin\AppData\Local\Temp\E9F2.tmp"41⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"C:\Users\Admin\AppData\Local\Temp\EA8F.tmp"42⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"C:\Users\Admin\AppData\Local\Temp\EB2B.tmp"43⤵
- Executes dropped EXE
PID:2184 -
C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"C:\Users\Admin\AppData\Local\Temp\EBD7.tmp"44⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\EC63.tmp"C:\Users\Admin\AppData\Local\Temp\EC63.tmp"45⤵
- Executes dropped EXE
PID:2156 -
C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"C:\Users\Admin\AppData\Local\Temp\ED1F.tmp"46⤵
- Executes dropped EXE
PID:4568 -
C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"C:\Users\Admin\AppData\Local\Temp\EDBB.tmp"47⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\EE29.tmp"C:\Users\Admin\AppData\Local\Temp\EE29.tmp"48⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\F04B.tmp"C:\Users\Admin\AppData\Local\Temp\F04B.tmp"49⤵
- Executes dropped EXE
PID:972 -
C:\Users\Admin\AppData\Local\Temp\F194.tmp"C:\Users\Admin\AppData\Local\Temp\F194.tmp"50⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\F25F.tmp"C:\Users\Admin\AppData\Local\Temp\F25F.tmp"51⤵
- Executes dropped EXE
PID:2464 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"52⤵
- Executes dropped EXE
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\F453.tmp"C:\Users\Admin\AppData\Local\Temp\F453.tmp"53⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\F53D.tmp"C:\Users\Admin\AppData\Local\Temp\F53D.tmp"54⤵
- Executes dropped EXE
PID:3172 -
C:\Users\Admin\AppData\Local\Temp\F608.tmp"C:\Users\Admin\AppData\Local\Temp\F608.tmp"55⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\F685.tmp"C:\Users\Admin\AppData\Local\Temp\F685.tmp"56⤵
- Executes dropped EXE
PID:704 -
C:\Users\Admin\AppData\Local\Temp\F702.tmp"C:\Users\Admin\AppData\Local\Temp\F702.tmp"57⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\F80C.tmp"C:\Users\Admin\AppData\Local\Temp\F80C.tmp"58⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp"59⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\F944.tmp"C:\Users\Admin\AppData\Local\Temp\F944.tmp"60⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"C:\Users\Admin\AppData\Local\Temp\F9B2.tmp"61⤵
- Executes dropped EXE
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"C:\Users\Admin\AppData\Local\Temp\FA4E.tmp"62⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"C:\Users\Admin\AppData\Local\Temp\FAFA.tmp"63⤵
- Executes dropped EXE
PID:3388 -
C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"C:\Users\Admin\AppData\Local\Temp\FBE4.tmp"64⤵
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"C:\Users\Admin\AppData\Local\Temp\FCBF.tmp"65⤵
- Executes dropped EXE
PID:2332 -
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"66⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\FE07.tmp"C:\Users\Admin\AppData\Local\Temp\FE07.tmp"67⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\FE94.tmp"C:\Users\Admin\AppData\Local\Temp\FE94.tmp"68⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"C:\Users\Admin\AppData\Local\Temp\FFBD.tmp"69⤵PID:3076
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"70⤵PID:1916
-
C:\Users\Admin\AppData\Local\Temp\E5.tmp"C:\Users\Admin\AppData\Local\Temp\E5.tmp"71⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\191.tmp"C:\Users\Admin\AppData\Local\Temp\191.tmp"72⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\23D.tmp"C:\Users\Admin\AppData\Local\Temp\23D.tmp"73⤵PID:4680
-
C:\Users\Admin\AppData\Local\Temp\2BA.tmp"C:\Users\Admin\AppData\Local\Temp\2BA.tmp"74⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\356.tmp"C:\Users\Admin\AppData\Local\Temp\356.tmp"75⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\3D3.tmp"C:\Users\Admin\AppData\Local\Temp\3D3.tmp"76⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\441.tmp"C:\Users\Admin\AppData\Local\Temp\441.tmp"77⤵PID:1320
-
C:\Users\Admin\AppData\Local\Temp\4DD.tmp"C:\Users\Admin\AppData\Local\Temp\4DD.tmp"78⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\54A.tmp"C:\Users\Admin\AppData\Local\Temp\54A.tmp"79⤵PID:4788
-
C:\Users\Admin\AppData\Local\Temp\5B8.tmp"C:\Users\Admin\AppData\Local\Temp\5B8.tmp"80⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\673.tmp"C:\Users\Admin\AppData\Local\Temp\673.tmp"81⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\72F.tmp"C:\Users\Admin\AppData\Local\Temp\72F.tmp"82⤵PID:2992
-
C:\Users\Admin\AppData\Local\Temp\7CB.tmp"C:\Users\Admin\AppData\Local\Temp\7CB.tmp"83⤵PID:312
-
C:\Users\Admin\AppData\Local\Temp\838.tmp"C:\Users\Admin\AppData\Local\Temp\838.tmp"84⤵PID:1196
-
C:\Users\Admin\AppData\Local\Temp\8B5.tmp"C:\Users\Admin\AppData\Local\Temp\8B5.tmp"85⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\952.tmp"C:\Users\Admin\AppData\Local\Temp\952.tmp"86⤵PID:3924
-
C:\Users\Admin\AppData\Local\Temp\9DE.tmp"C:\Users\Admin\AppData\Local\Temp\9DE.tmp"87⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\A4C.tmp"C:\Users\Admin\AppData\Local\Temp\A4C.tmp"88⤵PID:4436
-
C:\Users\Admin\AppData\Local\Temp\AC9.tmp"C:\Users\Admin\AppData\Local\Temp\AC9.tmp"89⤵PID:4880
-
C:\Users\Admin\AppData\Local\Temp\B84.tmp"C:\Users\Admin\AppData\Local\Temp\B84.tmp"90⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\BE2.tmp"C:\Users\Admin\AppData\Local\Temp\BE2.tmp"91⤵PID:1836
-
C:\Users\Admin\AppData\Local\Temp\C6F.tmp"C:\Users\Admin\AppData\Local\Temp\C6F.tmp"92⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\CDC.tmp"C:\Users\Admin\AppData\Local\Temp\CDC.tmp"93⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\D69.tmp"C:\Users\Admin\AppData\Local\Temp\D69.tmp"94⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"95⤵PID:4168
-
C:\Users\Admin\AppData\Local\Temp\EA1.tmp"C:\Users\Admin\AppData\Local\Temp\EA1.tmp"96⤵PID:4020
-
C:\Users\Admin\AppData\Local\Temp\F0E.tmp"C:\Users\Admin\AppData\Local\Temp\F0E.tmp"97⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\F8B.tmp"C:\Users\Admin\AppData\Local\Temp\F8B.tmp"98⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\1037.tmp"C:\Users\Admin\AppData\Local\Temp\1037.tmp"99⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\10E3.tmp"C:\Users\Admin\AppData\Local\Temp\10E3.tmp"100⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"101⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\11FC.tmp"C:\Users\Admin\AppData\Local\Temp\11FC.tmp"102⤵PID:1040
-
C:\Users\Admin\AppData\Local\Temp\1299.tmp"C:\Users\Admin\AppData\Local\Temp\1299.tmp"103⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\1316.tmp"C:\Users\Admin\AppData\Local\Temp\1316.tmp"104⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\1383.tmp"C:\Users\Admin\AppData\Local\Temp\1383.tmp"105⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"106⤵PID:4504
-
C:\Users\Admin\AppData\Local\Temp\147D.tmp"C:\Users\Admin\AppData\Local\Temp\147D.tmp"107⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\14FA.tmp"C:\Users\Admin\AppData\Local\Temp\14FA.tmp"108⤵PID:4688
-
C:\Users\Admin\AppData\Local\Temp\1577.tmp"C:\Users\Admin\AppData\Local\Temp\1577.tmp"109⤵PID:1184
-
C:\Users\Admin\AppData\Local\Temp\15F4.tmp"C:\Users\Admin\AppData\Local\Temp\15F4.tmp"110⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\16B0.tmp"C:\Users\Admin\AppData\Local\Temp\16B0.tmp"111⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\171D.tmp"C:\Users\Admin\AppData\Local\Temp\171D.tmp"112⤵PID:440
-
C:\Users\Admin\AppData\Local\Temp\179A.tmp"C:\Users\Admin\AppData\Local\Temp\179A.tmp"113⤵PID:2144
-
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"114⤵PID:748
-
C:\Users\Admin\AppData\Local\Temp\18F2.tmp"C:\Users\Admin\AppData\Local\Temp\18F2.tmp"115⤵PID:816
-
C:\Users\Admin\AppData\Local\Temp\197E.tmp"C:\Users\Admin\AppData\Local\Temp\197E.tmp"116⤵PID:3780
-
C:\Users\Admin\AppData\Local\Temp\19EC.tmp"C:\Users\Admin\AppData\Local\Temp\19EC.tmp"117⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"118⤵PID:5092
-
C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"C:\Users\Admin\AppData\Local\Temp\1BD0.tmp"119⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"120⤵PID:4468
-
C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"C:\Users\Admin\AppData\Local\Temp\1CDA.tmp"121⤵PID:2248
-
C:\Users\Admin\AppData\Local\Temp\1D66.tmp"C:\Users\Admin\AppData\Local\Temp\1D66.tmp"122⤵PID:2708
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-