Analysis
-
max time kernel
151s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22-10-2023 10:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe
-
Size
487KB
-
MD5
0664af8f2c30d25cc322fdae8242ca02
-
SHA1
8fd2436922113f0404dab391b8124a425b60c7f8
-
SHA256
4eff8dfc069f16f8cd9a2dbafffb47da77470e0ab37f0576d075b97289c585b7
-
SHA512
b9b1ebe1880054069d8057b293245f8663a5ec68e2afeff53eb5a406e831d1484c00410866ad955c401788ff0b15914db6214c554237a6bbc990478f9735d7ca
-
SSDEEP
12288:yU5rCOTeiNkQzG2qtPaeBcqq/H+/IWMPthYbZ:yUQOJNXzwaeBVn/IWMPteb
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4432 D0EC.tmp 4972 D198.tmp 1936 D273.tmp 3664 D30F.tmp 116 D3F9.tmp 3788 D476.tmp 3432 D551.tmp 4028 D5ED.tmp 3864 D68A.tmp 1764 D707.tmp 1372 D7E1.tmp 652 D88D.tmp 2560 D939.tmp 1716 D9B6.tmp 2200 DA52.tmp 3248 DADF.tmp 3280 DB8B.tmp 1692 DC08.tmp 3884 DC95.tmp 5060 DD12.tmp 1944 DD9E.tmp 1768 DE4A.tmp 1572 DEE6.tmp 1828 DFB1.tmp 1748 E04E.tmp 3888 E0BB.tmp 532 E167.tmp 4660 E1E4.tmp 4668 E2BF.tmp 3160 E38A.tmp 1908 E436.tmp 4628 E501.tmp 4292 E5AD.tmp 2540 E61A.tmp 3404 E6C6.tmp 3640 E733.tmp 1608 E7B0.tmp 3412 E83D.tmp 4236 E8D9.tmp 4368 E956.tmp 3860 E9E3.tmp 1512 EA7F.tmp 4532 EB0C.tmp 5016 EB98.tmp 4484 EC15.tmp 2892 EC83.tmp 4448 ED0F.tmp 1936 EDAC.tmp 3680 EE38.tmp 1176 EEB5.tmp 3468 EF42.tmp 1660 EFBF.tmp 3084 F05B.tmp 3128 F0C8.tmp 3548 F155.tmp 3148 F1E2.tmp 2064 F27E.tmp 3828 F2FB.tmp 552 F3A7.tmp 1764 F433.tmp 4124 F4B0.tmp 1372 F54D.tmp 5112 F5D9.tmp 5100 F656.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3040 wrote to memory of 4432 3040 NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe 85 PID 3040 wrote to memory of 4432 3040 NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe 85 PID 3040 wrote to memory of 4432 3040 NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe 85 PID 4432 wrote to memory of 4972 4432 D0EC.tmp 87 PID 4432 wrote to memory of 4972 4432 D0EC.tmp 87 PID 4432 wrote to memory of 4972 4432 D0EC.tmp 87 PID 4972 wrote to memory of 1936 4972 D198.tmp 89 PID 4972 wrote to memory of 1936 4972 D198.tmp 89 PID 4972 wrote to memory of 1936 4972 D198.tmp 89 PID 1936 wrote to memory of 3664 1936 D273.tmp 90 PID 1936 wrote to memory of 3664 1936 D273.tmp 90 PID 1936 wrote to memory of 3664 1936 D273.tmp 90 PID 3664 wrote to memory of 116 3664 D30F.tmp 92 PID 3664 wrote to memory of 116 3664 D30F.tmp 92 PID 3664 wrote to memory of 116 3664 D30F.tmp 92 PID 116 wrote to memory of 3788 116 D3F9.tmp 93 PID 116 wrote to memory of 3788 116 D3F9.tmp 93 PID 116 wrote to memory of 3788 116 D3F9.tmp 93 PID 3788 wrote to memory of 3432 3788 D476.tmp 94 PID 3788 wrote to memory of 3432 3788 D476.tmp 94 PID 3788 wrote to memory of 3432 3788 D476.tmp 94 PID 3432 wrote to memory of 4028 3432 D551.tmp 95 PID 3432 wrote to memory of 4028 3432 D551.tmp 95 PID 3432 wrote to memory of 4028 3432 D551.tmp 95 PID 4028 wrote to memory of 3864 4028 D5ED.tmp 96 PID 4028 wrote to memory of 3864 4028 D5ED.tmp 96 PID 4028 wrote to memory of 3864 4028 D5ED.tmp 96 PID 3864 wrote to memory of 1764 3864 D68A.tmp 97 PID 3864 wrote to memory of 1764 3864 D68A.tmp 97 PID 3864 wrote to memory of 1764 3864 D68A.tmp 97 PID 1764 wrote to memory of 1372 1764 D707.tmp 98 PID 1764 wrote to memory of 1372 1764 D707.tmp 98 PID 1764 wrote to memory of 1372 1764 D707.tmp 98 PID 1372 wrote to memory of 652 1372 D7E1.tmp 99 PID 1372 wrote to memory of 652 1372 D7E1.tmp 99 PID 1372 wrote to memory of 652 1372 D7E1.tmp 99 PID 652 wrote to memory of 2560 652 D88D.tmp 100 PID 652 wrote to memory of 2560 652 D88D.tmp 100 PID 652 wrote to memory of 2560 652 D88D.tmp 100 PID 2560 wrote to memory of 1716 2560 D939.tmp 101 PID 2560 wrote to memory of 1716 2560 D939.tmp 101 PID 2560 wrote to memory of 1716 2560 D939.tmp 101 PID 1716 wrote to memory of 2200 1716 D9B6.tmp 102 PID 1716 wrote to memory of 2200 1716 D9B6.tmp 102 PID 1716 wrote to memory of 2200 1716 D9B6.tmp 102 PID 2200 wrote to memory of 3248 2200 DA52.tmp 103 PID 2200 wrote to memory of 3248 2200 DA52.tmp 103 PID 2200 wrote to memory of 3248 2200 DA52.tmp 103 PID 3248 wrote to memory of 3280 3248 DADF.tmp 104 PID 3248 wrote to memory of 3280 3248 DADF.tmp 104 PID 3248 wrote to memory of 3280 3248 DADF.tmp 104 PID 3280 wrote to memory of 1692 3280 DB8B.tmp 105 PID 3280 wrote to memory of 1692 3280 DB8B.tmp 105 PID 3280 wrote to memory of 1692 3280 DB8B.tmp 105 PID 1692 wrote to memory of 3884 1692 DC08.tmp 106 PID 1692 wrote to memory of 3884 1692 DC08.tmp 106 PID 1692 wrote to memory of 3884 1692 DC08.tmp 106 PID 3884 wrote to memory of 5060 3884 DC95.tmp 108 PID 3884 wrote to memory of 5060 3884 DC95.tmp 108 PID 3884 wrote to memory of 5060 3884 DC95.tmp 108 PID 5060 wrote to memory of 1944 5060 DD12.tmp 109 PID 5060 wrote to memory of 1944 5060 DD12.tmp 109 PID 5060 wrote to memory of 1944 5060 DD12.tmp 109 PID 1944 wrote to memory of 1768 1944 DD9E.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-07_0664af8f2c30d25cc322fdae8242ca02_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"C:\Users\Admin\AppData\Local\Temp\D0EC.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\D198.tmp"C:\Users\Admin\AppData\Local\Temp\D198.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\D273.tmp"C:\Users\Admin\AppData\Local\Temp\D273.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"C:\Users\Admin\AppData\Local\Temp\D3F9.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\D551.tmp"C:\Users\Admin\AppData\Local\Temp\D551.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"C:\Users\Admin\AppData\Local\Temp\D5ED.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\D707.tmp"C:\Users\Admin\AppData\Local\Temp\D707.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"C:\Users\Admin\AppData\Local\Temp\D7E1.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\D88D.tmp"C:\Users\Admin\AppData\Local\Temp\D88D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Users\Admin\AppData\Local\Temp\D939.tmp"C:\Users\Admin\AppData\Local\Temp\D939.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"C:\Users\Admin\AppData\Local\Temp\D9B6.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Users\Admin\AppData\Local\Temp\DA52.tmp"C:\Users\Admin\AppData\Local\Temp\DA52.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\DADF.tmp"C:\Users\Admin\AppData\Local\Temp\DADF.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"C:\Users\Admin\AppData\Local\Temp\DB8B.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\DC08.tmp"C:\Users\Admin\AppData\Local\Temp\DC08.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\DC95.tmp"C:\Users\Admin\AppData\Local\Temp\DC95.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\DD12.tmp"C:\Users\Admin\AppData\Local\Temp\DD12.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"C:\Users\Admin\AppData\Local\Temp\DD9E.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"C:\Users\Admin\AppData\Local\Temp\DE4A.tmp"23⤵
- Executes dropped EXE
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"C:\Users\Admin\AppData\Local\Temp\DEE6.tmp"24⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"C:\Users\Admin\AppData\Local\Temp\DFB1.tmp"25⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Temp\E04E.tmp"C:\Users\Admin\AppData\Local\Temp\E04E.tmp"26⤵
- Executes dropped EXE
PID:1748 -
C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"C:\Users\Admin\AppData\Local\Temp\E0BB.tmp"27⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\E167.tmp"C:\Users\Admin\AppData\Local\Temp\E167.tmp"28⤵
- Executes dropped EXE
PID:532 -
C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"C:\Users\Admin\AppData\Local\Temp\E1E4.tmp"29⤵
- Executes dropped EXE
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"C:\Users\Admin\AppData\Local\Temp\E2BF.tmp"30⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\E38A.tmp"C:\Users\Admin\AppData\Local\Temp\E38A.tmp"31⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\E436.tmp"C:\Users\Admin\AppData\Local\Temp\E436.tmp"32⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\E501.tmp"C:\Users\Admin\AppData\Local\Temp\E501.tmp"33⤵
- Executes dropped EXE
PID:4628 -
C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"C:\Users\Admin\AppData\Local\Temp\E5AD.tmp"34⤵
- Executes dropped EXE
PID:4292 -
C:\Users\Admin\AppData\Local\Temp\E61A.tmp"C:\Users\Admin\AppData\Local\Temp\E61A.tmp"35⤵
- Executes dropped EXE
PID:2540 -
C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"C:\Users\Admin\AppData\Local\Temp\E6C6.tmp"36⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\E733.tmp"C:\Users\Admin\AppData\Local\Temp\E733.tmp"37⤵
- Executes dropped EXE
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"C:\Users\Admin\AppData\Local\Temp\E7B0.tmp"38⤵
- Executes dropped EXE
PID:1608 -
C:\Users\Admin\AppData\Local\Temp\E83D.tmp"C:\Users\Admin\AppData\Local\Temp\E83D.tmp"39⤵
- Executes dropped EXE
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"C:\Users\Admin\AppData\Local\Temp\E8D9.tmp"40⤵
- Executes dropped EXE
PID:4236 -
C:\Users\Admin\AppData\Local\Temp\E956.tmp"C:\Users\Admin\AppData\Local\Temp\E956.tmp"41⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"C:\Users\Admin\AppData\Local\Temp\E9E3.tmp"42⤵
- Executes dropped EXE
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"C:\Users\Admin\AppData\Local\Temp\EA7F.tmp"43⤵
- Executes dropped EXE
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"C:\Users\Admin\AppData\Local\Temp\EB0C.tmp"44⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\EB98.tmp"C:\Users\Admin\AppData\Local\Temp\EB98.tmp"45⤵
- Executes dropped EXE
PID:5016 -
C:\Users\Admin\AppData\Local\Temp\EC15.tmp"C:\Users\Admin\AppData\Local\Temp\EC15.tmp"46⤵
- Executes dropped EXE
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\EC83.tmp"C:\Users\Admin\AppData\Local\Temp\EC83.tmp"47⤵
- Executes dropped EXE
PID:2892 -
C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"C:\Users\Admin\AppData\Local\Temp\ED0F.tmp"48⤵
- Executes dropped EXE
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"C:\Users\Admin\AppData\Local\Temp\EDAC.tmp"49⤵
- Executes dropped EXE
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\EE38.tmp"C:\Users\Admin\AppData\Local\Temp\EE38.tmp"50⤵
- Executes dropped EXE
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"C:\Users\Admin\AppData\Local\Temp\EEB5.tmp"51⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\EF42.tmp"C:\Users\Admin\AppData\Local\Temp\EF42.tmp"52⤵
- Executes dropped EXE
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"C:\Users\Admin\AppData\Local\Temp\EFBF.tmp"53⤵
- Executes dropped EXE
PID:1660 -
C:\Users\Admin\AppData\Local\Temp\F05B.tmp"C:\Users\Admin\AppData\Local\Temp\F05B.tmp"54⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"C:\Users\Admin\AppData\Local\Temp\F0C8.tmp"55⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\F155.tmp"C:\Users\Admin\AppData\Local\Temp\F155.tmp"56⤵
- Executes dropped EXE
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"C:\Users\Admin\AppData\Local\Temp\F1E2.tmp"57⤵
- Executes dropped EXE
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\F27E.tmp"C:\Users\Admin\AppData\Local\Temp\F27E.tmp"58⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"C:\Users\Admin\AppData\Local\Temp\F2FB.tmp"59⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"C:\Users\Admin\AppData\Local\Temp\F3A7.tmp"60⤵
- Executes dropped EXE
PID:552 -
C:\Users\Admin\AppData\Local\Temp\F433.tmp"C:\Users\Admin\AppData\Local\Temp\F433.tmp"61⤵
- Executes dropped EXE
PID:1764 -
C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"C:\Users\Admin\AppData\Local\Temp\F4B0.tmp"62⤵
- Executes dropped EXE
PID:4124 -
C:\Users\Admin\AppData\Local\Temp\F54D.tmp"C:\Users\Admin\AppData\Local\Temp\F54D.tmp"63⤵
- Executes dropped EXE
PID:1372 -
C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"C:\Users\Admin\AppData\Local\Temp\F5D9.tmp"64⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\F656.tmp"C:\Users\Admin\AppData\Local\Temp\F656.tmp"65⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"C:\Users\Admin\AppData\Local\Temp\F6D3.tmp"66⤵PID:4768
-
C:\Users\Admin\AppData\Local\Temp\F750.tmp"C:\Users\Admin\AppData\Local\Temp\F750.tmp"67⤵PID:3644
-
C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"C:\Users\Admin\AppData\Local\Temp\F7DD.tmp"68⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\F879.tmp"C:\Users\Admin\AppData\Local\Temp\F879.tmp"69⤵PID:4460
-
C:\Users\Admin\AppData\Local\Temp\F915.tmp"C:\Users\Admin\AppData\Local\Temp\F915.tmp"70⤵PID:5108
-
C:\Users\Admin\AppData\Local\Temp\F983.tmp"C:\Users\Admin\AppData\Local\Temp\F983.tmp"71⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"C:\Users\Admin\AppData\Local\Temp\FA2F.tmp"72⤵PID:1868
-
C:\Users\Admin\AppData\Local\Temp\FB19.tmp"C:\Users\Admin\AppData\Local\Temp\FB19.tmp"73⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"C:\Users\Admin\AppData\Local\Temp\FBB5.tmp"74⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\FC42.tmp"C:\Users\Admin\AppData\Local\Temp\FC42.tmp"75⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"C:\Users\Admin\AppData\Local\Temp\FCCF.tmp"76⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"C:\Users\Admin\AppData\Local\Temp\FD4C.tmp"77⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"C:\Users\Admin\AppData\Local\Temp\FDE8.tmp"78⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\FE65.tmp"C:\Users\Admin\AppData\Local\Temp\FE65.tmp"79⤵PID:4656
-
C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"C:\Users\Admin\AppData\Local\Temp\FEF1.tmp"80⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"C:\Users\Admin\AppData\Local\Temp\FF7E.tmp"81⤵PID:4764
-
C:\Users\Admin\AppData\Local\Temp\2A.tmp"C:\Users\Admin\AppData\Local\Temp\2A.tmp"82⤵PID:2792
-
C:\Users\Admin\AppData\Local\Temp\B7.tmp"C:\Users\Admin\AppData\Local\Temp\B7.tmp"83⤵PID:4488
-
C:\Users\Admin\AppData\Local\Temp\162.tmp"C:\Users\Admin\AppData\Local\Temp\162.tmp"84⤵PID:1888
-
C:\Users\Admin\AppData\Local\Temp\1DF.tmp"C:\Users\Admin\AppData\Local\Temp\1DF.tmp"85⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\25C.tmp"C:\Users\Admin\AppData\Local\Temp\25C.tmp"86⤵PID:832
-
C:\Users\Admin\AppData\Local\Temp\2F9.tmp"C:\Users\Admin\AppData\Local\Temp\2F9.tmp"87⤵PID:1840
-
C:\Users\Admin\AppData\Local\Temp\385.tmp"C:\Users\Admin\AppData\Local\Temp\385.tmp"88⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\3F3.tmp"C:\Users\Admin\AppData\Local\Temp\3F3.tmp"89⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\470.tmp"C:\Users\Admin\AppData\Local\Temp\470.tmp"90⤵PID:452
-
C:\Users\Admin\AppData\Local\Temp\4FC.tmp"C:\Users\Admin\AppData\Local\Temp\4FC.tmp"91⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\5A8.tmp"C:\Users\Admin\AppData\Local\Temp\5A8.tmp"92⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\644.tmp"C:\Users\Admin\AppData\Local\Temp\644.tmp"93⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\6C1.tmp"C:\Users\Admin\AppData\Local\Temp\6C1.tmp"94⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\75E.tmp"C:\Users\Admin\AppData\Local\Temp\75E.tmp"95⤵PID:4784
-
C:\Users\Admin\AppData\Local\Temp\7EA.tmp"C:\Users\Admin\AppData\Local\Temp\7EA.tmp"96⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\867.tmp"C:\Users\Admin\AppData\Local\Temp\867.tmp"97⤵PID:1732
-
C:\Users\Admin\AppData\Local\Temp\8F4.tmp"C:\Users\Admin\AppData\Local\Temp\8F4.tmp"98⤵PID:4048
-
C:\Users\Admin\AppData\Local\Temp\990.tmp"C:\Users\Admin\AppData\Local\Temp\990.tmp"99⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\A1D.tmp"C:\Users\Admin\AppData\Local\Temp\A1D.tmp"100⤵PID:1608
-
C:\Users\Admin\AppData\Local\Temp\AA9.tmp"C:\Users\Admin\AppData\Local\Temp\AA9.tmp"101⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\B36.tmp"C:\Users\Admin\AppData\Local\Temp\B36.tmp"102⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\BB3.tmp"C:\Users\Admin\AppData\Local\Temp\BB3.tmp"103⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\C40.tmp"C:\Users\Admin\AppData\Local\Temp\C40.tmp"104⤵PID:1020
-
C:\Users\Admin\AppData\Local\Temp\CBD.tmp"C:\Users\Admin\AppData\Local\Temp\CBD.tmp"105⤵PID:2772
-
C:\Users\Admin\AppData\Local\Temp\D3A.tmp"C:\Users\Admin\AppData\Local\Temp\D3A.tmp"106⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\DC6.tmp"C:\Users\Admin\AppData\Local\Temp\DC6.tmp"107⤵PID:4432
-
C:\Users\Admin\AppData\Local\Temp\E34.tmp"C:\Users\Admin\AppData\Local\Temp\E34.tmp"108⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\EB1.tmp"C:\Users\Admin\AppData\Local\Temp\EB1.tmp"109⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\F1E.tmp"C:\Users\Admin\AppData\Local\Temp\F1E.tmp"110⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\F9B.tmp"C:\Users\Admin\AppData\Local\Temp\F9B.tmp"111⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\1057.tmp"C:\Users\Admin\AppData\Local\Temp\1057.tmp"112⤵PID:3664
-
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"113⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\1151.tmp"C:\Users\Admin\AppData\Local\Temp\1151.tmp"114⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\11DD.tmp"C:\Users\Admin\AppData\Local\Temp\11DD.tmp"115⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\125A.tmp"C:\Users\Admin\AppData\Local\Temp\125A.tmp"116⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\12E7.tmp"C:\Users\Admin\AppData\Local\Temp\12E7.tmp"117⤵PID:3084
-
C:\Users\Admin\AppData\Local\Temp\1373.tmp"C:\Users\Admin\AppData\Local\Temp\1373.tmp"118⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\1400.tmp"C:\Users\Admin\AppData\Local\Temp\1400.tmp"119⤵PID:4376
-
C:\Users\Admin\AppData\Local\Temp\146D.tmp"C:\Users\Admin\AppData\Local\Temp\146D.tmp"120⤵PID:3532
-
C:\Users\Admin\AppData\Local\Temp\150A.tmp"C:\Users\Admin\AppData\Local\Temp\150A.tmp"121⤵PID:232
-
C:\Users\Admin\AppData\Local\Temp\1587.tmp"C:\Users\Admin\AppData\Local\Temp\1587.tmp"122⤵PID:3828
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-