Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23-10-2023 16:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe
Resource
win10v2004-20231020-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe
-
Size
520KB
-
MD5
6e0ebfa6fb9b9979f9e3abc9aca88cef
-
SHA1
1f989f0a05e7634a0c01032b1688d936d13cb223
-
SHA256
86c00a6ce16d65066bc0183d0452e3061daea841dab4cff1e68d1dd8a6980674
-
SHA512
b86c873b91a089f20cf2129e961fbc19f1c9df100172b52a88334210d51ca82cf5c63d867f4f72090fe3d099055e989ab1c36842e6e25dbe044422c2bc50eb6f
-
SSDEEP
12288:roRXOQjmOyeuil+0HiF2hdvSzXqjfsX+NZ:rogQ9yeuiDCQzSDqjfxN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2316 8201.tmp 4652 82AD.tmp 700 8349.tmp 1016 83E5.tmp 1036 8482.tmp 4976 851E.tmp 1972 859B.tmp 3248 8647.tmp 1888 86B4.tmp 1812 8741.tmp 3292 87BE.tmp 752 882B.tmp 4404 88C7.tmp 3276 89C1.tmp 2532 8A4E.tmp 3892 8B0A.tmp 2612 8BB5.tmp 2180 8C32.tmp 4200 8CBF.tmp 4768 8D6B.tmp 916 8E46.tmp 556 8EA3.tmp 2004 8F20.tmp 2676 8FAD.tmp 1116 9069.tmp 2416 9105.tmp 4728 91B1.tmp 4268 923D.tmp 1152 92CA.tmp 4416 9357.tmp 1344 9402.tmp 976 949F.tmp 2576 954B.tmp 4412 95B8.tmp 4716 9645.tmp 5028 96D1.tmp 2392 974E.tmp 3100 97CB.tmp 2208 9839.tmp 4976 98B6.tmp 4676 9933.tmp 2028 99BF.tmp 376 9A3C.tmp 1888 9AAA.tmp 1252 9B36.tmp 3052 9BB3.tmp 4308 9C30.tmp 1380 9CBD.tmp 5056 9D3A.tmp 2988 9DB7.tmp 4700 9E15.tmp 3712 9E92.tmp 4248 9F3D.tmp 1452 9FCA.tmp 2784 A037.tmp 2812 A0E3.tmp 2460 A160.tmp 2132 A1ED.tmp 5092 A2D7.tmp 2172 A345.tmp 3664 A3F1.tmp 4388 A46E.tmp 3216 A4EB.tmp 1648 A548.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1556 wrote to memory of 2316 1556 NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe 86 PID 1556 wrote to memory of 2316 1556 NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe 86 PID 1556 wrote to memory of 2316 1556 NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe 86 PID 2316 wrote to memory of 4652 2316 8201.tmp 87 PID 2316 wrote to memory of 4652 2316 8201.tmp 87 PID 2316 wrote to memory of 4652 2316 8201.tmp 87 PID 4652 wrote to memory of 700 4652 82AD.tmp 89 PID 4652 wrote to memory of 700 4652 82AD.tmp 89 PID 4652 wrote to memory of 700 4652 82AD.tmp 89 PID 700 wrote to memory of 1016 700 8349.tmp 91 PID 700 wrote to memory of 1016 700 8349.tmp 91 PID 700 wrote to memory of 1016 700 8349.tmp 91 PID 1016 wrote to memory of 1036 1016 83E5.tmp 92 PID 1016 wrote to memory of 1036 1016 83E5.tmp 92 PID 1016 wrote to memory of 1036 1016 83E5.tmp 92 PID 1036 wrote to memory of 4976 1036 8482.tmp 93 PID 1036 wrote to memory of 4976 1036 8482.tmp 93 PID 1036 wrote to memory of 4976 1036 8482.tmp 93 PID 4976 wrote to memory of 1972 4976 851E.tmp 94 PID 4976 wrote to memory of 1972 4976 851E.tmp 94 PID 4976 wrote to memory of 1972 4976 851E.tmp 94 PID 1972 wrote to memory of 3248 1972 859B.tmp 95 PID 1972 wrote to memory of 3248 1972 859B.tmp 95 PID 1972 wrote to memory of 3248 1972 859B.tmp 95 PID 3248 wrote to memory of 1888 3248 8647.tmp 96 PID 3248 wrote to memory of 1888 3248 8647.tmp 96 PID 3248 wrote to memory of 1888 3248 8647.tmp 96 PID 1888 wrote to memory of 1812 1888 86B4.tmp 97 PID 1888 wrote to memory of 1812 1888 86B4.tmp 97 PID 1888 wrote to memory of 1812 1888 86B4.tmp 97 PID 1812 wrote to memory of 3292 1812 8741.tmp 98 PID 1812 wrote to memory of 3292 1812 8741.tmp 98 PID 1812 wrote to memory of 3292 1812 8741.tmp 98 PID 3292 wrote to memory of 752 3292 87BE.tmp 99 PID 3292 wrote to memory of 752 3292 87BE.tmp 99 PID 3292 wrote to memory of 752 3292 87BE.tmp 99 PID 752 wrote to memory of 4404 752 882B.tmp 100 PID 752 wrote to memory of 4404 752 882B.tmp 100 PID 752 wrote to memory of 4404 752 882B.tmp 100 PID 4404 wrote to memory of 3276 4404 88C7.tmp 101 PID 4404 wrote to memory of 3276 4404 88C7.tmp 101 PID 4404 wrote to memory of 3276 4404 88C7.tmp 101 PID 3276 wrote to memory of 2532 3276 89C1.tmp 102 PID 3276 wrote to memory of 2532 3276 89C1.tmp 102 PID 3276 wrote to memory of 2532 3276 89C1.tmp 102 PID 2532 wrote to memory of 3892 2532 8A4E.tmp 103 PID 2532 wrote to memory of 3892 2532 8A4E.tmp 103 PID 2532 wrote to memory of 3892 2532 8A4E.tmp 103 PID 3892 wrote to memory of 2612 3892 8B0A.tmp 104 PID 3892 wrote to memory of 2612 3892 8B0A.tmp 104 PID 3892 wrote to memory of 2612 3892 8B0A.tmp 104 PID 2612 wrote to memory of 2180 2612 8BB5.tmp 105 PID 2612 wrote to memory of 2180 2612 8BB5.tmp 105 PID 2612 wrote to memory of 2180 2612 8BB5.tmp 105 PID 2180 wrote to memory of 4200 2180 8C32.tmp 107 PID 2180 wrote to memory of 4200 2180 8C32.tmp 107 PID 2180 wrote to memory of 4200 2180 8C32.tmp 107 PID 4200 wrote to memory of 4768 4200 8CBF.tmp 108 PID 4200 wrote to memory of 4768 4200 8CBF.tmp 108 PID 4200 wrote to memory of 4768 4200 8CBF.tmp 108 PID 4768 wrote to memory of 916 4768 8D6B.tmp 109 PID 4768 wrote to memory of 916 4768 8D6B.tmp 109 PID 4768 wrote to memory of 916 4768 8D6B.tmp 109 PID 916 wrote to memory of 556 916 8E46.tmp 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_6e0ebfa6fb9b9979f9e3abc9aca88cef_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\8201.tmp"C:\Users\Admin\AppData\Local\Temp\8201.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\82AD.tmp"C:\Users\Admin\AppData\Local\Temp\82AD.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\8349.tmp"C:\Users\Admin\AppData\Local\Temp\8349.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\83E5.tmp"C:\Users\Admin\AppData\Local\Temp\83E5.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\8482.tmp"C:\Users\Admin\AppData\Local\Temp\8482.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\851E.tmp"C:\Users\Admin\AppData\Local\Temp\851E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\859B.tmp"C:\Users\Admin\AppData\Local\Temp\859B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\8647.tmp"C:\Users\Admin\AppData\Local\Temp\8647.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\86B4.tmp"C:\Users\Admin\AppData\Local\Temp\86B4.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\8741.tmp"C:\Users\Admin\AppData\Local\Temp\8741.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1812 -
C:\Users\Admin\AppData\Local\Temp\87BE.tmp"C:\Users\Admin\AppData\Local\Temp\87BE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\89C1.tmp"C:\Users\Admin\AppData\Local\Temp\89C1.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"C:\Users\Admin\AppData\Local\Temp\8A4E.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"C:\Users\Admin\AppData\Local\Temp\8B0A.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892 -
C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"C:\Users\Admin\AppData\Local\Temp\8BB5.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\8C32.tmp"C:\Users\Admin\AppData\Local\Temp\8C32.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"C:\Users\Admin\AppData\Local\Temp\8CBF.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\8E46.tmp"C:\Users\Admin\AppData\Local\Temp\8E46.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:916 -
C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"C:\Users\Admin\AppData\Local\Temp\8EA3.tmp"23⤵
- Executes dropped EXE
PID:556 -
C:\Users\Admin\AppData\Local\Temp\8F20.tmp"C:\Users\Admin\AppData\Local\Temp\8F20.tmp"24⤵
- Executes dropped EXE
PID:2004 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"25⤵
- Executes dropped EXE
PID:2676 -
C:\Users\Admin\AppData\Local\Temp\9069.tmp"C:\Users\Admin\AppData\Local\Temp\9069.tmp"26⤵
- Executes dropped EXE
PID:1116 -
C:\Users\Admin\AppData\Local\Temp\9105.tmp"C:\Users\Admin\AppData\Local\Temp\9105.tmp"27⤵
- Executes dropped EXE
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"28⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\923D.tmp"C:\Users\Admin\AppData\Local\Temp\923D.tmp"29⤵
- Executes dropped EXE
PID:4268 -
C:\Users\Admin\AppData\Local\Temp\92CA.tmp"C:\Users\Admin\AppData\Local\Temp\92CA.tmp"30⤵
- Executes dropped EXE
PID:1152 -
C:\Users\Admin\AppData\Local\Temp\9357.tmp"C:\Users\Admin\AppData\Local\Temp\9357.tmp"31⤵
- Executes dropped EXE
PID:4416 -
C:\Users\Admin\AppData\Local\Temp\9402.tmp"C:\Users\Admin\AppData\Local\Temp\9402.tmp"32⤵
- Executes dropped EXE
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\949F.tmp"C:\Users\Admin\AppData\Local\Temp\949F.tmp"33⤵
- Executes dropped EXE
PID:976 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"34⤵
- Executes dropped EXE
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\95B8.tmp"C:\Users\Admin\AppData\Local\Temp\95B8.tmp"35⤵
- Executes dropped EXE
PID:4412 -
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"36⤵
- Executes dropped EXE
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\96D1.tmp"C:\Users\Admin\AppData\Local\Temp\96D1.tmp"37⤵
- Executes dropped EXE
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"38⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"39⤵
- Executes dropped EXE
PID:3100 -
C:\Users\Admin\AppData\Local\Temp\9839.tmp"C:\Users\Admin\AppData\Local\Temp\9839.tmp"40⤵
- Executes dropped EXE
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\98B6.tmp"C:\Users\Admin\AppData\Local\Temp\98B6.tmp"41⤵
- Executes dropped EXE
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\9933.tmp"C:\Users\Admin\AppData\Local\Temp\9933.tmp"42⤵
- Executes dropped EXE
PID:4676 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"43⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"C:\Users\Admin\AppData\Local\Temp\9A3C.tmp"44⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"C:\Users\Admin\AppData\Local\Temp\9AAA.tmp"45⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"46⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"C:\Users\Admin\AppData\Local\Temp\9BB3.tmp"47⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"48⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"C:\Users\Admin\AppData\Local\Temp\9CBD.tmp"49⤵
- Executes dropped EXE
PID:1380 -
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"50⤵
- Executes dropped EXE
PID:5056 -
C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"C:\Users\Admin\AppData\Local\Temp\9DB7.tmp"51⤵
- Executes dropped EXE
PID:2988 -
C:\Users\Admin\AppData\Local\Temp\9E15.tmp"C:\Users\Admin\AppData\Local\Temp\9E15.tmp"52⤵
- Executes dropped EXE
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\9E92.tmp"C:\Users\Admin\AppData\Local\Temp\9E92.tmp"53⤵
- Executes dropped EXE
PID:3712 -
C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"C:\Users\Admin\AppData\Local\Temp\9F3D.tmp"54⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"C:\Users\Admin\AppData\Local\Temp\9FCA.tmp"55⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\A037.tmp"C:\Users\Admin\AppData\Local\Temp\A037.tmp"56⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"C:\Users\Admin\AppData\Local\Temp\A0E3.tmp"57⤵
- Executes dropped EXE
PID:2812 -
C:\Users\Admin\AppData\Local\Temp\A160.tmp"C:\Users\Admin\AppData\Local\Temp\A160.tmp"58⤵
- Executes dropped EXE
PID:2460 -
C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"C:\Users\Admin\AppData\Local\Temp\A1ED.tmp"59⤵
- Executes dropped EXE
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"60⤵
- Executes dropped EXE
PID:5092 -
C:\Users\Admin\AppData\Local\Temp\A345.tmp"C:\Users\Admin\AppData\Local\Temp\A345.tmp"61⤵
- Executes dropped EXE
PID:2172 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"62⤵
- Executes dropped EXE
PID:3664 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"63⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"C:\Users\Admin\AppData\Local\Temp\A4EB.tmp"64⤵
- Executes dropped EXE
PID:3216 -
C:\Users\Admin\AppData\Local\Temp\A548.tmp"C:\Users\Admin\AppData\Local\Temp\A548.tmp"65⤵
- Executes dropped EXE
PID:1648 -
C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"C:\Users\Admin\AppData\Local\Temp\A5B6.tmp"66⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\A623.tmp"C:\Users\Admin\AppData\Local\Temp\A623.tmp"67⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\A690.tmp"C:\Users\Admin\AppData\Local\Temp\A690.tmp"68⤵PID:4200
-
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"69⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\A76B.tmp"C:\Users\Admin\AppData\Local\Temp\A76B.tmp"70⤵PID:1232
-
C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"C:\Users\Admin\AppData\Local\Temp\A7D9.tmp"71⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"72⤵PID:4476
-
C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"C:\Users\Admin\AppData\Local\Temp\A8A4.tmp"73⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\A921.tmp"C:\Users\Admin\AppData\Local\Temp\A921.tmp"74⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"75⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"76⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"77⤵PID:4028
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"78⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"79⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"C:\Users\Admin\AppData\Local\Temp\AC1E.tmp"80⤵PID:3872
-
C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"C:\Users\Admin\AppData\Local\Temp\AC9B.tmp"81⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"C:\Users\Admin\AppData\Local\Temp\ACF9.tmp"82⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\AD66.tmp"C:\Users\Admin\AppData\Local\Temp\AD66.tmp"83⤵PID:180
-
C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"C:\Users\Admin\AppData\Local\Temp\ADD4.tmp"84⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\AE51.tmp"C:\Users\Admin\AppData\Local\Temp\AE51.tmp"85⤵PID:2916
-
C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"C:\Users\Admin\AppData\Local\Temp\AEAF.tmp"86⤵PID:4512
-
C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"C:\Users\Admin\AppData\Local\Temp\AF2C.tmp"87⤵PID:4268
-
C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"C:\Users\Admin\AppData\Local\Temp\AFA9.tmp"88⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\B026.tmp"C:\Users\Admin\AppData\Local\Temp\B026.tmp"89⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\B093.tmp"C:\Users\Admin\AppData\Local\Temp\B093.tmp"90⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\B100.tmp"C:\Users\Admin\AppData\Local\Temp\B100.tmp"91⤵PID:2500
-
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"92⤵PID:4940
-
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"93⤵PID:3436
-
C:\Users\Admin\AppData\Local\Temp\B268.tmp"C:\Users\Admin\AppData\Local\Temp\B268.tmp"94⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"95⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"96⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"C:\Users\Admin\AppData\Local\Temp\B3CF.tmp"97⤵PID:5096
-
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"98⤵PID:2392
-
C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"C:\Users\Admin\AppData\Local\Temp\B4B9.tmp"99⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\B527.tmp"C:\Users\Admin\AppData\Local\Temp\B527.tmp"100⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\B594.tmp"C:\Users\Admin\AppData\Local\Temp\B594.tmp"101⤵PID:4776
-
C:\Users\Admin\AppData\Local\Temp\B602.tmp"C:\Users\Admin\AppData\Local\Temp\B602.tmp"102⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\B66F.tmp"C:\Users\Admin\AppData\Local\Temp\B66F.tmp"103⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"C:\Users\Admin\AppData\Local\Temp\B6CD.tmp"104⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\B73A.tmp"C:\Users\Admin\AppData\Local\Temp\B73A.tmp"105⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"C:\Users\Admin\AppData\Local\Temp\B7C7.tmp"106⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\B834.tmp"C:\Users\Admin\AppData\Local\Temp\B834.tmp"107⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"108⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\B92E.tmp"C:\Users\Admin\AppData\Local\Temp\B92E.tmp"109⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\B99B.tmp"C:\Users\Admin\AppData\Local\Temp\B99B.tmp"110⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\BA18.tmp"C:\Users\Admin\AppData\Local\Temp\BA18.tmp"111⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\BA76.tmp"C:\Users\Admin\AppData\Local\Temp\BA76.tmp"112⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"C:\Users\Admin\AppData\Local\Temp\BAE4.tmp"113⤵PID:3476
-
C:\Users\Admin\AppData\Local\Temp\BB51.tmp"C:\Users\Admin\AppData\Local\Temp\BB51.tmp"114⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"C:\Users\Admin\AppData\Local\Temp\BBBE.tmp"115⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"116⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"C:\Users\Admin\AppData\Local\Temp\BCB8.tmp"117⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"118⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"119⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\BE00.tmp"C:\Users\Admin\AppData\Local\Temp\BE00.tmp"120⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"121⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\BF49.tmp"C:\Users\Admin\AppData\Local\Temp\BF49.tmp"122⤵PID:2460
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-