Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/10/2023, 09:55
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe
Resource
win10v2004-20231020-en
General
-
Target
NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe
-
Size
520KB
-
MD5
ff6a8951ce9c76d49fc07b75afaf634d
-
SHA1
5fe4636f439da740666ff3fe71d0675ce002eabc
-
SHA256
e68dabae2362c855e56f88b04a128c5548b9abe3d6ce619aed63a76b2f71cfb3
-
SHA512
6dc7669537ea87cb2e4893549df5c526de357d372a7acbc80aa19d0448a43166c93a8744a9fc609f8f40bdf1be420a7bbc729fb3819b3b895042a8fd415979de
-
SSDEEP
6144:lLvd/XzCjUIF1UuXLyQjmOH+JjLCg/S55MXTwPkitzWgYsAdkBwDoM1c2rsH3dZ:roRXOQjmOyf/S55MXTlazfYfkBR2QNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3204 8C90.tmp 4704 8D2C.tmp 2844 8E65.tmp 676 8F20.tmp 3728 8F9D.tmp 3392 9069.tmp 552 9134.tmp 4384 91D0.tmp 2852 92BA.tmp 4204 9376.tmp 3416 949F.tmp 4996 9579.tmp 4044 9616.tmp 3360 96D1.tmp 432 97AC.tmp 1400 9839.tmp 4308 98D5.tmp 1700 99A0.tmp 4460 9A4C.tmp 2496 9B27.tmp 3024 9C11.tmp 2312 9CFB.tmp 2336 9D78.tmp 2528 9E05.tmp 2520 9ED0.tmp 1788 9FAB.tmp 4740 A076.tmp 4804 A141.tmp 2432 A1FD.tmp 2304 A2C8.tmp 3504 A364.tmp 5112 A43F.tmp 4008 A50A.tmp 4276 A587.tmp 3004 A5F4.tmp 2092 A681.tmp 3340 A6DF.tmp 3864 A77B.tmp 3920 A807.tmp 3880 A884.tmp 5040 A911.tmp 5084 A99E.tmp 1812 B4F8.tmp 1860 B97C.tmp 776 BA18.tmp 1048 BFA6.tmp 2920 C0A0.tmp 4920 C11D.tmp 2844 C19A.tmp 2900 C217.tmp 1996 C2A4.tmp 3604 C321.tmp 3728 C39E.tmp 3080 C42B.tmp 3768 C4A8.tmp 4536 C841.tmp 3076 C8CE.tmp 3724 C95B.tmp 4376 C9E7.tmp 4360 CA64.tmp 1500 CE7B.tmp 2056 CF08.tmp 4204 CF85.tmp 4960 D021.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 216 wrote to memory of 3204 216 NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe 87 PID 216 wrote to memory of 3204 216 NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe 87 PID 216 wrote to memory of 3204 216 NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe 87 PID 3204 wrote to memory of 4704 3204 8C90.tmp 88 PID 3204 wrote to memory of 4704 3204 8C90.tmp 88 PID 3204 wrote to memory of 4704 3204 8C90.tmp 88 PID 4704 wrote to memory of 2844 4704 8D2C.tmp 90 PID 4704 wrote to memory of 2844 4704 8D2C.tmp 90 PID 4704 wrote to memory of 2844 4704 8D2C.tmp 90 PID 2844 wrote to memory of 676 2844 8E65.tmp 91 PID 2844 wrote to memory of 676 2844 8E65.tmp 91 PID 2844 wrote to memory of 676 2844 8E65.tmp 91 PID 676 wrote to memory of 3728 676 8F20.tmp 92 PID 676 wrote to memory of 3728 676 8F20.tmp 92 PID 676 wrote to memory of 3728 676 8F20.tmp 92 PID 3728 wrote to memory of 3392 3728 8F9D.tmp 93 PID 3728 wrote to memory of 3392 3728 8F9D.tmp 93 PID 3728 wrote to memory of 3392 3728 8F9D.tmp 93 PID 3392 wrote to memory of 552 3392 9069.tmp 94 PID 3392 wrote to memory of 552 3392 9069.tmp 94 PID 3392 wrote to memory of 552 3392 9069.tmp 94 PID 552 wrote to memory of 4384 552 9134.tmp 95 PID 552 wrote to memory of 4384 552 9134.tmp 95 PID 552 wrote to memory of 4384 552 9134.tmp 95 PID 4384 wrote to memory of 2852 4384 91D0.tmp 96 PID 4384 wrote to memory of 2852 4384 91D0.tmp 96 PID 4384 wrote to memory of 2852 4384 91D0.tmp 96 PID 2852 wrote to memory of 4204 2852 92BA.tmp 97 PID 2852 wrote to memory of 4204 2852 92BA.tmp 97 PID 2852 wrote to memory of 4204 2852 92BA.tmp 97 PID 4204 wrote to memory of 3416 4204 9376.tmp 99 PID 4204 wrote to memory of 3416 4204 9376.tmp 99 PID 4204 wrote to memory of 3416 4204 9376.tmp 99 PID 3416 wrote to memory of 4996 3416 949F.tmp 100 PID 3416 wrote to memory of 4996 3416 949F.tmp 100 PID 3416 wrote to memory of 4996 3416 949F.tmp 100 PID 4996 wrote to memory of 4044 4996 9579.tmp 101 PID 4996 wrote to memory of 4044 4996 9579.tmp 101 PID 4996 wrote to memory of 4044 4996 9579.tmp 101 PID 4044 wrote to memory of 3360 4044 9616.tmp 102 PID 4044 wrote to memory of 3360 4044 9616.tmp 102 PID 4044 wrote to memory of 3360 4044 9616.tmp 102 PID 3360 wrote to memory of 432 3360 96D1.tmp 103 PID 3360 wrote to memory of 432 3360 96D1.tmp 103 PID 3360 wrote to memory of 432 3360 96D1.tmp 103 PID 432 wrote to memory of 1400 432 97AC.tmp 105 PID 432 wrote to memory of 1400 432 97AC.tmp 105 PID 432 wrote to memory of 1400 432 97AC.tmp 105 PID 1400 wrote to memory of 4308 1400 9839.tmp 106 PID 1400 wrote to memory of 4308 1400 9839.tmp 106 PID 1400 wrote to memory of 4308 1400 9839.tmp 106 PID 4308 wrote to memory of 1700 4308 98D5.tmp 107 PID 4308 wrote to memory of 1700 4308 98D5.tmp 107 PID 4308 wrote to memory of 1700 4308 98D5.tmp 107 PID 1700 wrote to memory of 4460 1700 99A0.tmp 108 PID 1700 wrote to memory of 4460 1700 99A0.tmp 108 PID 1700 wrote to memory of 4460 1700 99A0.tmp 108 PID 4460 wrote to memory of 2496 4460 9A4C.tmp 109 PID 4460 wrote to memory of 2496 4460 9A4C.tmp 109 PID 4460 wrote to memory of 2496 4460 9A4C.tmp 109 PID 2496 wrote to memory of 3024 2496 9B27.tmp 110 PID 2496 wrote to memory of 3024 2496 9B27.tmp 110 PID 2496 wrote to memory of 3024 2496 9B27.tmp 110 PID 3024 wrote to memory of 2312 3024 9C11.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_ff6a8951ce9c76d49fc07b75afaf634d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Users\Admin\AppData\Local\Temp\8C90.tmp"C:\Users\Admin\AppData\Local\Temp\8C90.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"C:\Users\Admin\AppData\Local\Temp\8D2C.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\8E65.tmp"C:\Users\Admin\AppData\Local\Temp\8E65.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\9134.tmp"C:\Users\Admin\AppData\Local\Temp\9134.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\91D0.tmp"C:\Users\Admin\AppData\Local\Temp\91D0.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\92BA.tmp"C:\Users\Admin\AppData\Local\Temp\92BA.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\9376.tmp"C:\Users\Admin\AppData\Local\Temp\9376.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\9579.tmp"C:\Users\Admin\AppData\Local\Temp\9579.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\9616.tmp"C:\Users\Admin\AppData\Local\Temp\9616.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\97AC.tmp"C:\Users\Admin\AppData\Local\Temp\97AC.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\98D5.tmp"C:\Users\Admin\AppData\Local\Temp\98D5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\99A0.tmp"C:\Users\Admin\AppData\Local\Temp\99A0.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"C:\Users\Admin\AppData\Local\Temp\9A4C.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\9B27.tmp"C:\Users\Admin\AppData\Local\Temp\9B27.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\9C11.tmp"C:\Users\Admin\AppData\Local\Temp\9C11.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"23⤵
- Executes dropped EXE
PID:2312 -
C:\Users\Admin\AppData\Local\Temp\9D78.tmp"C:\Users\Admin\AppData\Local\Temp\9D78.tmp"24⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\9E05.tmp"C:\Users\Admin\AppData\Local\Temp\9E05.tmp"25⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"C:\Users\Admin\AppData\Local\Temp\9ED0.tmp"26⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"C:\Users\Admin\AppData\Local\Temp\9FAB.tmp"27⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"28⤵
- Executes dropped EXE
PID:4740 -
C:\Users\Admin\AppData\Local\Temp\A141.tmp"C:\Users\Admin\AppData\Local\Temp\A141.tmp"29⤵
- Executes dropped EXE
PID:4804 -
C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"C:\Users\Admin\AppData\Local\Temp\A1FD.tmp"30⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"31⤵
- Executes dropped EXE
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"32⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\A43F.tmp"C:\Users\Admin\AppData\Local\Temp\A43F.tmp"33⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A50A.tmp"C:\Users\Admin\AppData\Local\Temp\A50A.tmp"34⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"35⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"C:\Users\Admin\AppData\Local\Temp\A5F4.tmp"36⤵
- Executes dropped EXE
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\A681.tmp"C:\Users\Admin\AppData\Local\Temp\A681.tmp"37⤵
- Executes dropped EXE
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"C:\Users\Admin\AppData\Local\Temp\A6DF.tmp"38⤵
- Executes dropped EXE
PID:3340 -
C:\Users\Admin\AppData\Local\Temp\A77B.tmp"C:\Users\Admin\AppData\Local\Temp\A77B.tmp"39⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\A807.tmp"C:\Users\Admin\AppData\Local\Temp\A807.tmp"40⤵
- Executes dropped EXE
PID:3920 -
C:\Users\Admin\AppData\Local\Temp\A884.tmp"C:\Users\Admin\AppData\Local\Temp\A884.tmp"41⤵
- Executes dropped EXE
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\A911.tmp"C:\Users\Admin\AppData\Local\Temp\A911.tmp"42⤵
- Executes dropped EXE
PID:5040 -
C:\Users\Admin\AppData\Local\Temp\A99E.tmp"C:\Users\Admin\AppData\Local\Temp\A99E.tmp"43⤵
- Executes dropped EXE
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"C:\Users\Admin\AppData\Local\Temp\B4F8.tmp"44⤵
- Executes dropped EXE
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\B97C.tmp"C:\Users\Admin\AppData\Local\Temp\B97C.tmp"45⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"46⤵
- Executes dropped EXE
PID:776 -
C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"C:\Users\Admin\AppData\Local\Temp\BFA6.tmp"47⤵
- Executes dropped EXE
PID:1048 -
C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"C:\Users\Admin\AppData\Local\Temp\C0A0.tmp"48⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\C11D.tmp"C:\Users\Admin\AppData\Local\Temp\C11D.tmp"49⤵
- Executes dropped EXE
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\C19A.tmp"C:\Users\Admin\AppData\Local\Temp\C19A.tmp"50⤵
- Executes dropped EXE
PID:2844 -
C:\Users\Admin\AppData\Local\Temp\C217.tmp"C:\Users\Admin\AppData\Local\Temp\C217.tmp"51⤵
- Executes dropped EXE
PID:2900 -
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"52⤵
- Executes dropped EXE
PID:1996 -
C:\Users\Admin\AppData\Local\Temp\C321.tmp"C:\Users\Admin\AppData\Local\Temp\C321.tmp"53⤵
- Executes dropped EXE
PID:3604 -
C:\Users\Admin\AppData\Local\Temp\C39E.tmp"C:\Users\Admin\AppData\Local\Temp\C39E.tmp"54⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\C42B.tmp"C:\Users\Admin\AppData\Local\Temp\C42B.tmp"55⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"C:\Users\Admin\AppData\Local\Temp\C4A8.tmp"56⤵
- Executes dropped EXE
PID:3768 -
C:\Users\Admin\AppData\Local\Temp\C841.tmp"C:\Users\Admin\AppData\Local\Temp\C841.tmp"57⤵
- Executes dropped EXE
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"C:\Users\Admin\AppData\Local\Temp\C8CE.tmp"58⤵
- Executes dropped EXE
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\C95B.tmp"C:\Users\Admin\AppData\Local\Temp\C95B.tmp"59⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"C:\Users\Admin\AppData\Local\Temp\C9E7.tmp"60⤵
- Executes dropped EXE
PID:4376 -
C:\Users\Admin\AppData\Local\Temp\CA64.tmp"C:\Users\Admin\AppData\Local\Temp\CA64.tmp"61⤵
- Executes dropped EXE
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"62⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\CF08.tmp"C:\Users\Admin\AppData\Local\Temp\CF08.tmp"63⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\CF85.tmp"C:\Users\Admin\AppData\Local\Temp\CF85.tmp"64⤵
- Executes dropped EXE
PID:4204 -
C:\Users\Admin\AppData\Local\Temp\D021.tmp"C:\Users\Admin\AppData\Local\Temp\D021.tmp"65⤵
- Executes dropped EXE
PID:4960 -
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"66⤵PID:3744
-
C:\Users\Admin\AppData\Local\Temp\D15A.tmp"C:\Users\Admin\AppData\Local\Temp\D15A.tmp"67⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"C:\Users\Admin\AppData\Local\Temp\D1D7.tmp"68⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\D254.tmp"C:\Users\Admin\AppData\Local\Temp\D254.tmp"69⤵PID:3232
-
C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"C:\Users\Admin\AppData\Local\Temp\D2E0.tmp"70⤵PID:844
-
C:\Users\Admin\AppData\Local\Temp\D34E.tmp"C:\Users\Admin\AppData\Local\Temp\D34E.tmp"71⤵PID:4556
-
C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"C:\Users\Admin\AppData\Local\Temp\D3CB.tmp"72⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\D457.tmp"C:\Users\Admin\AppData\Local\Temp\D457.tmp"73⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"C:\Users\Admin\AppData\Local\Temp\D4E4.tmp"74⤵PID:4320
-
C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"C:\Users\Admin\AppData\Local\Temp\DB3D.tmp"75⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"C:\Users\Admin\AppData\Local\Temp\DBBA.tmp"76⤵PID:3292
-
C:\Users\Admin\AppData\Local\Temp\DC37.tmp"C:\Users\Admin\AppData\Local\Temp\DC37.tmp"77⤵PID:1424
-
C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"C:\Users\Admin\AppData\Local\Temp\DCB4.tmp"78⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\DD40.tmp"C:\Users\Admin\AppData\Local\Temp\DD40.tmp"79⤵PID:852
-
C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"C:\Users\Admin\AppData\Local\Temp\DDCD.tmp"80⤵PID:3020
-
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"81⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"C:\Users\Admin\AppData\Local\Temp\DEA8.tmp"82⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\DF34.tmp"C:\Users\Admin\AppData\Local\Temp\DF34.tmp"83⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"84⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"85⤵PID:4872
-
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"86⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"C:\Users\Admin\AppData\Local\Temp\E3F7.tmp"87⤵PID:1156
-
C:\Users\Admin\AppData\Local\Temp\E474.tmp"C:\Users\Admin\AppData\Local\Temp\E474.tmp"88⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\E510.tmp"C:\Users\Admin\AppData\Local\Temp\E510.tmp"89⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\E59D.tmp"C:\Users\Admin\AppData\Local\Temp\E59D.tmp"90⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"91⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"C:\Users\Admin\AppData\Local\Temp\E6A7.tmp"92⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"93⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"C:\Users\Admin\AppData\Local\Temp\E7C0.tmp"94⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\E85C.tmp"C:\Users\Admin\AppData\Local\Temp\E85C.tmp"95⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"C:\Users\Admin\AppData\Local\Temp\E8E9.tmp"96⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\E966.tmp"C:\Users\Admin\AppData\Local\Temp\E966.tmp"97⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\EA02.tmp"C:\Users\Admin\AppData\Local\Temp\EA02.tmp"98⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"C:\Users\Admin\AppData\Local\Temp\EA6F.tmp"99⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"100⤵PID:484
-
C:\Users\Admin\AppData\Local\Temp\EB89.tmp"C:\Users\Admin\AppData\Local\Temp\EB89.tmp"101⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\EC06.tmp"C:\Users\Admin\AppData\Local\Temp\EC06.tmp"102⤵PID:724
-
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"103⤵PID:4848
-
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"104⤵PID:216
-
C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"C:\Users\Admin\AppData\Local\Temp\ED8C.tmp"105⤵PID:1948
-
C:\Users\Admin\AppData\Local\Temp\EE19.tmp"C:\Users\Admin\AppData\Local\Temp\EE19.tmp"106⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"C:\Users\Admin\AppData\Local\Temp\EEC5.tmp"107⤵PID:3880
-
C:\Users\Admin\AppData\Local\Temp\EF61.tmp"C:\Users\Admin\AppData\Local\Temp\EF61.tmp"108⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"C:\Users\Admin\AppData\Local\Temp\EFCE.tmp"109⤵PID:364
-
C:\Users\Admin\AppData\Local\Temp\F03C.tmp"C:\Users\Admin\AppData\Local\Temp\F03C.tmp"110⤵PID:1120
-
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"111⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\F145.tmp"C:\Users\Admin\AppData\Local\Temp\F145.tmp"112⤵PID:3040
-
C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"C:\Users\Admin\AppData\Local\Temp\F1D2.tmp"113⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\F24F.tmp"C:\Users\Admin\AppData\Local\Temp\F24F.tmp"114⤵PID:776
-
C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"C:\Users\Admin\AppData\Local\Temp\F2CC.tmp"115⤵PID:1048
-
C:\Users\Admin\AppData\Local\Temp\F349.tmp"C:\Users\Admin\AppData\Local\Temp\F349.tmp"116⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"C:\Users\Admin\AppData\Local\Temp\F3E5.tmp"117⤵PID:4920
-
C:\Users\Admin\AppData\Local\Temp\F462.tmp"C:\Users\Admin\AppData\Local\Temp\F462.tmp"118⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"C:\Users\Admin\AppData\Local\Temp\F4EF.tmp"119⤵PID:2900
-
C:\Users\Admin\AppData\Local\Temp\F56C.tmp"C:\Users\Admin\AppData\Local\Temp\F56C.tmp"120⤵PID:1996
-
C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"C:\Users\Admin\AppData\Local\Temp\F5F9.tmp"121⤵PID:3604
-
C:\Users\Admin\AppData\Local\Temp\F695.tmp"C:\Users\Admin\AppData\Local\Temp\F695.tmp"122⤵PID:3728
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-