Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe
Resource
win7-20231020-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe
Resource
win10v2004-20231020-en
2 signatures
150 seconds
General
-
Target
NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe
-
Size
488KB
-
MD5
d3d8ddd2d98e1df0b7765bfb7b321061
-
SHA1
c53219550cab89eff17a7bbb74a5685afc85a3dd
-
SHA256
08daafc9bf83929e8c23847c694572071aca0e6bbb174a769daec0036373d3b0
-
SHA512
2fec1c312fe7bde47c64440e68af48babdbc6907e5afc7591c0a5432ffed04b6b4c6182c6fd5ceaad79f562ce77b99e24740d1e55c2d2c70514caeb0385d82fb
-
SSDEEP
12288:/U5rCOTeiD7hPLymB8NU3HnxdXS9/XNZ:/UQOJD7rB8NvXN
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 5068 9683.tmp 3812 972F.tmp 1036 97DB.tmp 4780 9877.tmp 3884 9913.tmp 4456 99BF.tmp 2276 9A6B.tmp 4860 9AE8.tmp 4132 9B75.tmp 4652 9C01.tmp 4216 9CAD.tmp 3724 9D2A.tmp 672 9DA7.tmp 4808 9E43.tmp 2764 9EFF.tmp 536 9FDA.tmp 2132 A076.tmp 1664 A0F3.tmp 2208 A170.tmp 2364 A24B.tmp 4000 A2C8.tmp 4156 A364.tmp 2068 A400.tmp 3540 A4BC.tmp 5112 A577.tmp 1200 A613.tmp 1784 A6B0.tmp 4576 A72D.tmp 2828 A7C9.tmp 4552 A846.tmp 928 A901.tmp 4972 A9AD.tmp 3244 AA2A.tmp 816 AAA7.tmp 2032 AB24.tmp 2216 ABA1.tmp 4300 AD18.tmp 1956 AD95.tmp 3264 AE22.tmp 3732 AEBE.tmp 3588 AF3B.tmp 2796 AFC8.tmp 1348 B054.tmp 3488 B0E1.tmp 3268 B16E.tmp 3888 B1EB.tmp 4128 B277.tmp 2292 B2D5.tmp 1592 B352.tmp 1992 B3B0.tmp 464 B43C.tmp 5116 B4C9.tmp 3596 B546.tmp 3828 B5C3.tmp 4480 B630.tmp 4108 B69E.tmp 4860 B71B.tmp 4120 B798.tmp 1492 B844.tmp 4436 B8D0.tmp 4464 B95D.tmp 2896 B9DA.tmp 3516 BA57.tmp 1364 BAF3.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3732 wrote to memory of 5068 3732 NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe 86 PID 3732 wrote to memory of 5068 3732 NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe 86 PID 3732 wrote to memory of 5068 3732 NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe 86 PID 5068 wrote to memory of 3812 5068 9683.tmp 87 PID 5068 wrote to memory of 3812 5068 9683.tmp 87 PID 5068 wrote to memory of 3812 5068 9683.tmp 87 PID 3812 wrote to memory of 1036 3812 972F.tmp 88 PID 3812 wrote to memory of 1036 3812 972F.tmp 88 PID 3812 wrote to memory of 1036 3812 972F.tmp 88 PID 1036 wrote to memory of 4780 1036 97DB.tmp 90 PID 1036 wrote to memory of 4780 1036 97DB.tmp 90 PID 1036 wrote to memory of 4780 1036 97DB.tmp 90 PID 4780 wrote to memory of 3884 4780 9877.tmp 91 PID 4780 wrote to memory of 3884 4780 9877.tmp 91 PID 4780 wrote to memory of 3884 4780 9877.tmp 91 PID 3884 wrote to memory of 4456 3884 9913.tmp 92 PID 3884 wrote to memory of 4456 3884 9913.tmp 92 PID 3884 wrote to memory of 4456 3884 9913.tmp 92 PID 4456 wrote to memory of 2276 4456 99BF.tmp 94 PID 4456 wrote to memory of 2276 4456 99BF.tmp 94 PID 4456 wrote to memory of 2276 4456 99BF.tmp 94 PID 2276 wrote to memory of 4860 2276 9A6B.tmp 95 PID 2276 wrote to memory of 4860 2276 9A6B.tmp 95 PID 2276 wrote to memory of 4860 2276 9A6B.tmp 95 PID 4860 wrote to memory of 4132 4860 9AE8.tmp 96 PID 4860 wrote to memory of 4132 4860 9AE8.tmp 96 PID 4860 wrote to memory of 4132 4860 9AE8.tmp 96 PID 4132 wrote to memory of 4652 4132 9B75.tmp 97 PID 4132 wrote to memory of 4652 4132 9B75.tmp 97 PID 4132 wrote to memory of 4652 4132 9B75.tmp 97 PID 4652 wrote to memory of 4216 4652 9C01.tmp 98 PID 4652 wrote to memory of 4216 4652 9C01.tmp 98 PID 4652 wrote to memory of 4216 4652 9C01.tmp 98 PID 4216 wrote to memory of 3724 4216 9CAD.tmp 99 PID 4216 wrote to memory of 3724 4216 9CAD.tmp 99 PID 4216 wrote to memory of 3724 4216 9CAD.tmp 99 PID 3724 wrote to memory of 672 3724 9D2A.tmp 100 PID 3724 wrote to memory of 672 3724 9D2A.tmp 100 PID 3724 wrote to memory of 672 3724 9D2A.tmp 100 PID 672 wrote to memory of 4808 672 9DA7.tmp 101 PID 672 wrote to memory of 4808 672 9DA7.tmp 101 PID 672 wrote to memory of 4808 672 9DA7.tmp 101 PID 4808 wrote to memory of 2764 4808 9E43.tmp 102 PID 4808 wrote to memory of 2764 4808 9E43.tmp 102 PID 4808 wrote to memory of 2764 4808 9E43.tmp 102 PID 2764 wrote to memory of 536 2764 9EFF.tmp 103 PID 2764 wrote to memory of 536 2764 9EFF.tmp 103 PID 2764 wrote to memory of 536 2764 9EFF.tmp 103 PID 536 wrote to memory of 2132 536 9FDA.tmp 105 PID 536 wrote to memory of 2132 536 9FDA.tmp 105 PID 536 wrote to memory of 2132 536 9FDA.tmp 105 PID 2132 wrote to memory of 1664 2132 A076.tmp 106 PID 2132 wrote to memory of 1664 2132 A076.tmp 106 PID 2132 wrote to memory of 1664 2132 A076.tmp 106 PID 1664 wrote to memory of 2208 1664 A0F3.tmp 107 PID 1664 wrote to memory of 2208 1664 A0F3.tmp 107 PID 1664 wrote to memory of 2208 1664 A0F3.tmp 107 PID 2208 wrote to memory of 2364 2208 A170.tmp 108 PID 2208 wrote to memory of 2364 2208 A170.tmp 108 PID 2208 wrote to memory of 2364 2208 A170.tmp 108 PID 2364 wrote to memory of 4000 2364 A24B.tmp 109 PID 2364 wrote to memory of 4000 2364 A24B.tmp 109 PID 2364 wrote to memory of 4000 2364 A24B.tmp 109 PID 4000 wrote to memory of 4156 4000 A2C8.tmp 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_d3d8ddd2d98e1df0b7765bfb7b321061_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\9683.tmp"C:\Users\Admin\AppData\Local\Temp\9683.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\972F.tmp"C:\Users\Admin\AppData\Local\Temp\972F.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3812 -
C:\Users\Admin\AppData\Local\Temp\97DB.tmp"C:\Users\Admin\AppData\Local\Temp\97DB.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\9913.tmp"C:\Users\Admin\AppData\Local\Temp\9913.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Users\Admin\AppData\Local\Temp\99BF.tmp"C:\Users\Admin\AppData\Local\Temp\99BF.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"C:\Users\Admin\AppData\Local\Temp\9A6B.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"C:\Users\Admin\AppData\Local\Temp\9AE8.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4132 -
C:\Users\Admin\AppData\Local\Temp\9C01.tmp"C:\Users\Admin\AppData\Local\Temp\9C01.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"C:\Users\Admin\AppData\Local\Temp\9D2A.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Users\Admin\AppData\Local\Temp\9E43.tmp"C:\Users\Admin\AppData\Local\Temp\9E43.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4808 -
C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"C:\Users\Admin\AppData\Local\Temp\9EFF.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"C:\Users\Admin\AppData\Local\Temp\9FDA.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\A076.tmp"C:\Users\Admin\AppData\Local\Temp\A076.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"C:\Users\Admin\AppData\Local\Temp\A0F3.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\A170.tmp"C:\Users\Admin\AppData\Local\Temp\A170.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Users\Admin\AppData\Local\Temp\A24B.tmp"C:\Users\Admin\AppData\Local\Temp\A24B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"C:\Users\Admin\AppData\Local\Temp\A2C8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Users\Admin\AppData\Local\Temp\A364.tmp"C:\Users\Admin\AppData\Local\Temp\A364.tmp"23⤵
- Executes dropped EXE
PID:4156 -
C:\Users\Admin\AppData\Local\Temp\A400.tmp"C:\Users\Admin\AppData\Local\Temp\A400.tmp"24⤵
- Executes dropped EXE
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"C:\Users\Admin\AppData\Local\Temp\A4BC.tmp"25⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"26⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\A613.tmp"C:\Users\Admin\AppData\Local\Temp\A613.tmp"27⤵
- Executes dropped EXE
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"C:\Users\Admin\AppData\Local\Temp\A6B0.tmp"28⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\A72D.tmp"C:\Users\Admin\AppData\Local\Temp\A72D.tmp"29⤵
- Executes dropped EXE
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"C:\Users\Admin\AppData\Local\Temp\A7C9.tmp"30⤵
- Executes dropped EXE
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\A846.tmp"C:\Users\Admin\AppData\Local\Temp\A846.tmp"31⤵
- Executes dropped EXE
PID:4552 -
C:\Users\Admin\AppData\Local\Temp\A901.tmp"C:\Users\Admin\AppData\Local\Temp\A901.tmp"32⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"C:\Users\Admin\AppData\Local\Temp\A9AD.tmp"33⤵
- Executes dropped EXE
PID:4972 -
C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"C:\Users\Admin\AppData\Local\Temp\AA2A.tmp"34⤵
- Executes dropped EXE
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"C:\Users\Admin\AppData\Local\Temp\AAA7.tmp"35⤵
- Executes dropped EXE
PID:816 -
C:\Users\Admin\AppData\Local\Temp\AB24.tmp"C:\Users\Admin\AppData\Local\Temp\AB24.tmp"36⤵
- Executes dropped EXE
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"C:\Users\Admin\AppData\Local\Temp\ABA1.tmp"37⤵
- Executes dropped EXE
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"38⤵
- Executes dropped EXE
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\AD95.tmp"C:\Users\Admin\AppData\Local\Temp\AD95.tmp"39⤵
- Executes dropped EXE
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"40⤵
- Executes dropped EXE
PID:3264 -
C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"C:\Users\Admin\AppData\Local\Temp\AEBE.tmp"41⤵
- Executes dropped EXE
PID:3732 -
C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"C:\Users\Admin\AppData\Local\Temp\AF3B.tmp"42⤵
- Executes dropped EXE
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"C:\Users\Admin\AppData\Local\Temp\AFC8.tmp"43⤵
- Executes dropped EXE
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\B054.tmp"C:\Users\Admin\AppData\Local\Temp\B054.tmp"44⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"C:\Users\Admin\AppData\Local\Temp\B0E1.tmp"45⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\B16E.tmp"C:\Users\Admin\AppData\Local\Temp\B16E.tmp"46⤵
- Executes dropped EXE
PID:3268 -
C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"C:\Users\Admin\AppData\Local\Temp\B1EB.tmp"47⤵
- Executes dropped EXE
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\B277.tmp"C:\Users\Admin\AppData\Local\Temp\B277.tmp"48⤵
- Executes dropped EXE
PID:4128 -
C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"C:\Users\Admin\AppData\Local\Temp\B2D5.tmp"49⤵
- Executes dropped EXE
PID:2292 -
C:\Users\Admin\AppData\Local\Temp\B352.tmp"C:\Users\Admin\AppData\Local\Temp\B352.tmp"50⤵
- Executes dropped EXE
PID:1592 -
C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"C:\Users\Admin\AppData\Local\Temp\B3B0.tmp"51⤵
- Executes dropped EXE
PID:1992 -
C:\Users\Admin\AppData\Local\Temp\B43C.tmp"C:\Users\Admin\AppData\Local\Temp\B43C.tmp"52⤵
- Executes dropped EXE
PID:464 -
C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"C:\Users\Admin\AppData\Local\Temp\B4C9.tmp"53⤵
- Executes dropped EXE
PID:5116 -
C:\Users\Admin\AppData\Local\Temp\B546.tmp"C:\Users\Admin\AppData\Local\Temp\B546.tmp"54⤵
- Executes dropped EXE
PID:3596 -
C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"C:\Users\Admin\AppData\Local\Temp\B5C3.tmp"55⤵
- Executes dropped EXE
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\B630.tmp"C:\Users\Admin\AppData\Local\Temp\B630.tmp"56⤵
- Executes dropped EXE
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\B69E.tmp"C:\Users\Admin\AppData\Local\Temp\B69E.tmp"57⤵
- Executes dropped EXE
PID:4108 -
C:\Users\Admin\AppData\Local\Temp\B71B.tmp"C:\Users\Admin\AppData\Local\Temp\B71B.tmp"58⤵
- Executes dropped EXE
PID:4860 -
C:\Users\Admin\AppData\Local\Temp\B798.tmp"C:\Users\Admin\AppData\Local\Temp\B798.tmp"59⤵
- Executes dropped EXE
PID:4120 -
C:\Users\Admin\AppData\Local\Temp\B844.tmp"C:\Users\Admin\AppData\Local\Temp\B844.tmp"60⤵
- Executes dropped EXE
PID:1492 -
C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"C:\Users\Admin\AppData\Local\Temp\B8D0.tmp"61⤵
- Executes dropped EXE
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\B95D.tmp"C:\Users\Admin\AppData\Local\Temp\B95D.tmp"62⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"63⤵
- Executes dropped EXE
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\BA57.tmp"C:\Users\Admin\AppData\Local\Temp\BA57.tmp"64⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"C:\Users\Admin\AppData\Local\Temp\BAF3.tmp"65⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"C:\Users\Admin\AppData\Local\Temp\BB9F.tmp"66⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"C:\Users\Admin\AppData\Local\Temp\BC1C.tmp"67⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\BC99.tmp"C:\Users\Admin\AppData\Local\Temp\BC99.tmp"68⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\BD06.tmp"C:\Users\Admin\AppData\Local\Temp\BD06.tmp"69⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\BD74.tmp"C:\Users\Admin\AppData\Local\Temp\BD74.tmp"70⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"C:\Users\Admin\AppData\Local\Temp\BDE1.tmp"71⤵PID:2928
-
C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"C:\Users\Admin\AppData\Local\Temp\BE4F.tmp"72⤵PID:4424
-
C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"C:\Users\Admin\AppData\Local\Temp\BEBC.tmp"73⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\BF39.tmp"C:\Users\Admin\AppData\Local\Temp\BF39.tmp"74⤵PID:2472
-
C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"C:\Users\Admin\AppData\Local\Temp\BFD5.tmp"75⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\C052.tmp"C:\Users\Admin\AppData\Local\Temp\C052.tmp"76⤵PID:2100
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"77⤵PID:1612
-
C:\Users\Admin\AppData\Local\Temp\C14C.tmp"C:\Users\Admin\AppData\Local\Temp\C14C.tmp"78⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"C:\Users\Admin\AppData\Local\Temp\C1BA.tmp"79⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\C227.tmp"C:\Users\Admin\AppData\Local\Temp\C227.tmp"80⤵PID:3204
-
C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"C:\Users\Admin\AppData\Local\Temp\C2A4.tmp"81⤵PID:1636
-
C:\Users\Admin\AppData\Local\Temp\C311.tmp"C:\Users\Admin\AppData\Local\Temp\C311.tmp"82⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\C38E.tmp"C:\Users\Admin\AppData\Local\Temp\C38E.tmp"83⤵PID:1432
-
C:\Users\Admin\AppData\Local\Temp\C41B.tmp"C:\Users\Admin\AppData\Local\Temp\C41B.tmp"84⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\C498.tmp"C:\Users\Admin\AppData\Local\Temp\C498.tmp"85⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\C515.tmp"C:\Users\Admin\AppData\Local\Temp\C515.tmp"86⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"C:\Users\Admin\AppData\Local\Temp\C5A2.tmp"87⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"88⤵PID:2124
-
C:\Users\Admin\AppData\Local\Temp\C68C.tmp"C:\Users\Admin\AppData\Local\Temp\C68C.tmp"89⤵PID:4136
-
C:\Users\Admin\AppData\Local\Temp\C709.tmp"C:\Users\Admin\AppData\Local\Temp\C709.tmp"90⤵PID:4360
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"91⤵PID:764
-
C:\Users\Admin\AppData\Local\Temp\C813.tmp"C:\Users\Admin\AppData\Local\Temp\C813.tmp"92⤵PID:4396
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"93⤵PID:3752
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"94⤵PID:4324
-
C:\Users\Admin\AppData\Local\Temp\C97A.tmp"C:\Users\Admin\AppData\Local\Temp\C97A.tmp"95⤵PID:2240
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"96⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"97⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"C:\Users\Admin\AppData\Local\Temp\CAF1.tmp"98⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"C:\Users\Admin\AppData\Local\Temp\CB9D.tmp"99⤵PID:4868
-
C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"C:\Users\Admin\AppData\Local\Temp\CC1A.tmp"100⤵PID:2816
-
C:\Users\Admin\AppData\Local\Temp\CC87.tmp"C:\Users\Admin\AppData\Local\Temp\CC87.tmp"101⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\CD14.tmp"C:\Users\Admin\AppData\Local\Temp\CD14.tmp"102⤵PID:3264
-
C:\Users\Admin\AppData\Local\Temp\CD81.tmp"C:\Users\Admin\AppData\Local\Temp\CD81.tmp"103⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"C:\Users\Admin\AppData\Local\Temp\CDEF.tmp"104⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"C:\Users\Admin\AppData\Local\Temp\CE7B.tmp"105⤵PID:1036
-
C:\Users\Admin\AppData\Local\Temp\CED9.tmp"C:\Users\Admin\AppData\Local\Temp\CED9.tmp"106⤵PID:4752
-
C:\Users\Admin\AppData\Local\Temp\CF56.tmp"C:\Users\Admin\AppData\Local\Temp\CF56.tmp"107⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"C:\Users\Admin\AppData\Local\Temp\CFD3.tmp"108⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\D040.tmp"C:\Users\Admin\AppData\Local\Temp\D040.tmp"109⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"C:\Users\Admin\AppData\Local\Temp\D0BD.tmp"110⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\D13A.tmp"C:\Users\Admin\AppData\Local\Temp\D13A.tmp"111⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"C:\Users\Admin\AppData\Local\Temp\D1B7.tmp"112⤵PID:2640
-
C:\Users\Admin\AppData\Local\Temp\D234.tmp"C:\Users\Admin\AppData\Local\Temp\D234.tmp"113⤵PID:3152
-
C:\Users\Admin\AppData\Local\Temp\D292.tmp"C:\Users\Admin\AppData\Local\Temp\D292.tmp"114⤵PID:4792
-
C:\Users\Admin\AppData\Local\Temp\D30F.tmp"C:\Users\Admin\AppData\Local\Temp\D30F.tmp"115⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\D37C.tmp"C:\Users\Admin\AppData\Local\Temp\D37C.tmp"116⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\D409.tmp"C:\Users\Admin\AppData\Local\Temp\D409.tmp"117⤵PID:3876
-
C:\Users\Admin\AppData\Local\Temp\D476.tmp"C:\Users\Admin\AppData\Local\Temp\D476.tmp"118⤵PID:4016
-
C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"C:\Users\Admin\AppData\Local\Temp\D4F3.tmp"119⤵PID:396
-
C:\Users\Admin\AppData\Local\Temp\D590.tmp"C:\Users\Admin\AppData\Local\Temp\D590.tmp"120⤵PID:2384
-
C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"C:\Users\Admin\AppData\Local\Temp\D5FD.tmp"121⤵PID:3128
-
C:\Users\Admin\AppData\Local\Temp\D68A.tmp"C:\Users\Admin\AppData\Local\Temp\D68A.tmp"122⤵PID:3556
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-