Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 18:05
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe
Resource
win7-20231020-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe
Resource
win10v2004-20231020-en
2 signatures
150 seconds
General
-
Target
NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe
-
Size
488KB
-
MD5
d2ba37c4bdc448685023c5f27b04f78d
-
SHA1
e79f0291636746c0b9c8038936950fdbff9eb15b
-
SHA256
6d57f764e143c3b34ae1513ddf52fa1ddcb4d8dd771d5719c2a105e102a7aa70
-
SHA512
5ab4d0eb8b20df3704bd484fe06c88b7ea25b8fbbc1c8153c8e7b2d8411fe268db3aecf3fedb3e0edbeaa79f907b5a1dd04e108ccb81a2a81cb1773765fb6149
-
SSDEEP
12288:/U5rCOTeiDoh7A2V02MCHIzbUy7v8vPqW4NZ:/UQOJD67A2VkCHIzbfjyyW4N
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 780 8E94.tmp 404 8F9D.tmp 4776 9059.tmp 536 90E6.tmp 392 9191.tmp 456 921E.tmp 2180 92AB.tmp 1656 9328.tmp 3680 93A5.tmp 388 9422.tmp 1236 94CE.tmp 1540 954B.tmp 3120 9606.tmp 2216 974E.tmp 4272 97CB.tmp 2616 9B36.tmp 3372 9BE2.tmp 5060 9C4F.tmp 872 9CFB.tmp 3488 9D88.tmp 4148 9E34.tmp 2160 9EA1.tmp 4304 9F0F.tmp 380 9F9B.tmp 4196 A047.tmp 3876 A0A5.tmp 4052 A151.tmp 2060 A1BE.tmp 780 A25A.tmp 4368 A2D7.tmp 1832 A383.tmp 1588 A3F1.tmp 5012 A46E.tmp 1264 A4CB.tmp 1600 A529.tmp 1544 A587.tmp 4496 A604.tmp 4596 A671.tmp 1148 A6EE.tmp 1364 A75C.tmp 4756 A7E8.tmp 3572 A875.tmp 3620 A8E2.tmp 3392 A96F.tmp 2520 A9EC.tmp 2244 AA59.tmp 1540 AAC7.tmp 3512 AB53.tmp 2920 AC8C.tmp 5108 AD09.tmp 4340 AD86.tmp 1536 AE03.tmp 3160 AE8F.tmp 2448 AEED.tmp 2328 AF6A.tmp 4652 AFD7.tmp 2808 B035.tmp 1908 B0C2.tmp 1216 B13F.tmp 5060 B19D.tmp 1884 B21A.tmp 2628 B287.tmp 1556 B304.tmp 3488 B381.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 780 1900 NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe 90 PID 1900 wrote to memory of 780 1900 NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe 90 PID 1900 wrote to memory of 780 1900 NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe 90 PID 780 wrote to memory of 404 780 8E94.tmp 91 PID 780 wrote to memory of 404 780 8E94.tmp 91 PID 780 wrote to memory of 404 780 8E94.tmp 91 PID 404 wrote to memory of 4776 404 8F9D.tmp 92 PID 404 wrote to memory of 4776 404 8F9D.tmp 92 PID 404 wrote to memory of 4776 404 8F9D.tmp 92 PID 4776 wrote to memory of 536 4776 9059.tmp 93 PID 4776 wrote to memory of 536 4776 9059.tmp 93 PID 4776 wrote to memory of 536 4776 9059.tmp 93 PID 536 wrote to memory of 392 536 90E6.tmp 94 PID 536 wrote to memory of 392 536 90E6.tmp 94 PID 536 wrote to memory of 392 536 90E6.tmp 94 PID 392 wrote to memory of 456 392 9191.tmp 95 PID 392 wrote to memory of 456 392 9191.tmp 95 PID 392 wrote to memory of 456 392 9191.tmp 95 PID 456 wrote to memory of 2180 456 921E.tmp 96 PID 456 wrote to memory of 2180 456 921E.tmp 96 PID 456 wrote to memory of 2180 456 921E.tmp 96 PID 2180 wrote to memory of 1656 2180 92AB.tmp 97 PID 2180 wrote to memory of 1656 2180 92AB.tmp 97 PID 2180 wrote to memory of 1656 2180 92AB.tmp 97 PID 1656 wrote to memory of 3680 1656 9328.tmp 98 PID 1656 wrote to memory of 3680 1656 9328.tmp 98 PID 1656 wrote to memory of 3680 1656 9328.tmp 98 PID 3680 wrote to memory of 388 3680 93A5.tmp 100 PID 3680 wrote to memory of 388 3680 93A5.tmp 100 PID 3680 wrote to memory of 388 3680 93A5.tmp 100 PID 388 wrote to memory of 1236 388 9422.tmp 101 PID 388 wrote to memory of 1236 388 9422.tmp 101 PID 388 wrote to memory of 1236 388 9422.tmp 101 PID 1236 wrote to memory of 1540 1236 94CE.tmp 102 PID 1236 wrote to memory of 1540 1236 94CE.tmp 102 PID 1236 wrote to memory of 1540 1236 94CE.tmp 102 PID 1540 wrote to memory of 3120 1540 954B.tmp 103 PID 1540 wrote to memory of 3120 1540 954B.tmp 103 PID 1540 wrote to memory of 3120 1540 954B.tmp 103 PID 3120 wrote to memory of 2216 3120 9606.tmp 104 PID 3120 wrote to memory of 2216 3120 9606.tmp 104 PID 3120 wrote to memory of 2216 3120 9606.tmp 104 PID 2216 wrote to memory of 4272 2216 974E.tmp 106 PID 2216 wrote to memory of 4272 2216 974E.tmp 106 PID 2216 wrote to memory of 4272 2216 974E.tmp 106 PID 4272 wrote to memory of 2616 4272 97CB.tmp 108 PID 4272 wrote to memory of 2616 4272 97CB.tmp 108 PID 4272 wrote to memory of 2616 4272 97CB.tmp 108 PID 2616 wrote to memory of 3372 2616 9B36.tmp 109 PID 2616 wrote to memory of 3372 2616 9B36.tmp 109 PID 2616 wrote to memory of 3372 2616 9B36.tmp 109 PID 3372 wrote to memory of 5060 3372 9BE2.tmp 110 PID 3372 wrote to memory of 5060 3372 9BE2.tmp 110 PID 3372 wrote to memory of 5060 3372 9BE2.tmp 110 PID 5060 wrote to memory of 872 5060 9C4F.tmp 111 PID 5060 wrote to memory of 872 5060 9C4F.tmp 111 PID 5060 wrote to memory of 872 5060 9C4F.tmp 111 PID 872 wrote to memory of 3488 872 9CFB.tmp 112 PID 872 wrote to memory of 3488 872 9CFB.tmp 112 PID 872 wrote to memory of 3488 872 9CFB.tmp 112 PID 3488 wrote to memory of 4148 3488 9D88.tmp 113 PID 3488 wrote to memory of 4148 3488 9D88.tmp 113 PID 3488 wrote to memory of 4148 3488 9D88.tmp 113 PID 4148 wrote to memory of 2160 4148 9E34.tmp 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-05_d2ba37c4bdc448685023c5f27b04f78d_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\8E94.tmp"C:\Users\Admin\AppData\Local\Temp\8E94.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"C:\Users\Admin\AppData\Local\Temp\8F9D.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\9059.tmp"C:\Users\Admin\AppData\Local\Temp\9059.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\90E6.tmp"C:\Users\Admin\AppData\Local\Temp\90E6.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Users\Admin\AppData\Local\Temp\9191.tmp"C:\Users\Admin\AppData\Local\Temp\9191.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:392 -
C:\Users\Admin\AppData\Local\Temp\921E.tmp"C:\Users\Admin\AppData\Local\Temp\921E.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Users\Admin\AppData\Local\Temp\92AB.tmp"C:\Users\Admin\AppData\Local\Temp\92AB.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\9328.tmp"C:\Users\Admin\AppData\Local\Temp\9328.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Users\Admin\AppData\Local\Temp\93A5.tmp"C:\Users\Admin\AppData\Local\Temp\93A5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Local\Temp\94CE.tmp"C:\Users\Admin\AppData\Local\Temp\94CE.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\954B.tmp"C:\Users\Admin\AppData\Local\Temp\954B.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\9606.tmp"C:\Users\Admin\AppData\Local\Temp\9606.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\974E.tmp"C:\Users\Admin\AppData\Local\Temp\974E.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\97CB.tmp"C:\Users\Admin\AppData\Local\Temp\97CB.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Users\Admin\AppData\Local\Temp\9B36.tmp"C:\Users\Admin\AppData\Local\Temp\9B36.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"C:\Users\Admin\AppData\Local\Temp\9BE2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"C:\Users\Admin\AppData\Local\Temp\9C4F.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"C:\Users\Admin\AppData\Local\Temp\9CFB.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\9D88.tmp"C:\Users\Admin\AppData\Local\Temp\9D88.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\9E34.tmp"C:\Users\Admin\AppData\Local\Temp\9E34.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"23⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"C:\Users\Admin\AppData\Local\Temp\9F0F.tmp"24⤵
- Executes dropped EXE
PID:4304 -
C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"C:\Users\Admin\AppData\Local\Temp\9F9B.tmp"25⤵
- Executes dropped EXE
PID:380 -
C:\Users\Admin\AppData\Local\Temp\A047.tmp"C:\Users\Admin\AppData\Local\Temp\A047.tmp"26⤵
- Executes dropped EXE
PID:4196 -
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"27⤵
- Executes dropped EXE
PID:3876 -
C:\Users\Admin\AppData\Local\Temp\A151.tmp"C:\Users\Admin\AppData\Local\Temp\A151.tmp"28⤵
- Executes dropped EXE
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"C:\Users\Admin\AppData\Local\Temp\A1BE.tmp"29⤵
- Executes dropped EXE
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\A25A.tmp"C:\Users\Admin\AppData\Local\Temp\A25A.tmp"30⤵
- Executes dropped EXE
PID:780 -
C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"C:\Users\Admin\AppData\Local\Temp\A2D7.tmp"31⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\A383.tmp"C:\Users\Admin\AppData\Local\Temp\A383.tmp"32⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"C:\Users\Admin\AppData\Local\Temp\A3F1.tmp"33⤵
- Executes dropped EXE
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\A46E.tmp"C:\Users\Admin\AppData\Local\Temp\A46E.tmp"34⤵
- Executes dropped EXE
PID:5012 -
C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"C:\Users\Admin\AppData\Local\Temp\A4CB.tmp"35⤵
- Executes dropped EXE
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\A529.tmp"C:\Users\Admin\AppData\Local\Temp\A529.tmp"36⤵
- Executes dropped EXE
PID:1600 -
C:\Users\Admin\AppData\Local\Temp\A587.tmp"C:\Users\Admin\AppData\Local\Temp\A587.tmp"37⤵
- Executes dropped EXE
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\A604.tmp"C:\Users\Admin\AppData\Local\Temp\A604.tmp"38⤵
- Executes dropped EXE
PID:4496 -
C:\Users\Admin\AppData\Local\Temp\A671.tmp"C:\Users\Admin\AppData\Local\Temp\A671.tmp"39⤵
- Executes dropped EXE
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"C:\Users\Admin\AppData\Local\Temp\A6EE.tmp"40⤵
- Executes dropped EXE
PID:1148 -
C:\Users\Admin\AppData\Local\Temp\A75C.tmp"C:\Users\Admin\AppData\Local\Temp\A75C.tmp"41⤵
- Executes dropped EXE
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"42⤵
- Executes dropped EXE
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\A875.tmp"C:\Users\Admin\AppData\Local\Temp\A875.tmp"43⤵
- Executes dropped EXE
PID:3572 -
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"44⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\A96F.tmp"C:\Users\Admin\AppData\Local\Temp\A96F.tmp"45⤵
- Executes dropped EXE
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"46⤵
- Executes dropped EXE
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"47⤵
- Executes dropped EXE
PID:2244 -
C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"C:\Users\Admin\AppData\Local\Temp\AAC7.tmp"48⤵
- Executes dropped EXE
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\AB53.tmp"C:\Users\Admin\AppData\Local\Temp\AB53.tmp"49⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"C:\Users\Admin\AppData\Local\Temp\AC8C.tmp"50⤵
- Executes dropped EXE
PID:2920 -
C:\Users\Admin\AppData\Local\Temp\AD09.tmp"C:\Users\Admin\AppData\Local\Temp\AD09.tmp"51⤵
- Executes dropped EXE
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\AD86.tmp"C:\Users\Admin\AppData\Local\Temp\AD86.tmp"52⤵
- Executes dropped EXE
PID:4340 -
C:\Users\Admin\AppData\Local\Temp\AE03.tmp"C:\Users\Admin\AppData\Local\Temp\AE03.tmp"53⤵
- Executes dropped EXE
PID:1536 -
C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"C:\Users\Admin\AppData\Local\Temp\AE8F.tmp"54⤵
- Executes dropped EXE
PID:3160 -
C:\Users\Admin\AppData\Local\Temp\AEED.tmp"C:\Users\Admin\AppData\Local\Temp\AEED.tmp"55⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"C:\Users\Admin\AppData\Local\Temp\AF6A.tmp"56⤵
- Executes dropped EXE
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"C:\Users\Admin\AppData\Local\Temp\AFD7.tmp"57⤵
- Executes dropped EXE
PID:4652 -
C:\Users\Admin\AppData\Local\Temp\B035.tmp"C:\Users\Admin\AppData\Local\Temp\B035.tmp"58⤵
- Executes dropped EXE
PID:2808 -
C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"C:\Users\Admin\AppData\Local\Temp\B0C2.tmp"59⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\B13F.tmp"C:\Users\Admin\AppData\Local\Temp\B13F.tmp"60⤵
- Executes dropped EXE
PID:1216 -
C:\Users\Admin\AppData\Local\Temp\B19D.tmp"C:\Users\Admin\AppData\Local\Temp\B19D.tmp"61⤵
- Executes dropped EXE
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\B21A.tmp"C:\Users\Admin\AppData\Local\Temp\B21A.tmp"62⤵
- Executes dropped EXE
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\B287.tmp"C:\Users\Admin\AppData\Local\Temp\B287.tmp"63⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Temp\B304.tmp"C:\Users\Admin\AppData\Local\Temp\B304.tmp"64⤵
- Executes dropped EXE
PID:1556 -
C:\Users\Admin\AppData\Local\Temp\B381.tmp"C:\Users\Admin\AppData\Local\Temp\B381.tmp"65⤵
- Executes dropped EXE
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"C:\Users\Admin\AppData\Local\Temp\B3EE.tmp"66⤵PID:1488
-
C:\Users\Admin\AppData\Local\Temp\B46B.tmp"C:\Users\Admin\AppData\Local\Temp\B46B.tmp"67⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"C:\Users\Admin\AppData\Local\Temp\B4D9.tmp"68⤵PID:4808
-
C:\Users\Admin\AppData\Local\Temp\B575.tmp"C:\Users\Admin\AppData\Local\Temp\B575.tmp"69⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"C:\Users\Admin\AppData\Local\Temp\B5E2.tmp"70⤵PID:1532
-
C:\Users\Admin\AppData\Local\Temp\B65F.tmp"C:\Users\Admin\AppData\Local\Temp\B65F.tmp"71⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"C:\Users\Admin\AppData\Local\Temp\B6EC.tmp"72⤵PID:4924
-
C:\Users\Admin\AppData\Local\Temp\B769.tmp"C:\Users\Admin\AppData\Local\Temp\B769.tmp"73⤵PID:2280
-
C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"C:\Users\Admin\AppData\Local\Temp\B7D6.tmp"74⤵PID:4208
-
C:\Users\Admin\AppData\Local\Temp\B853.tmp"C:\Users\Admin\AppData\Local\Temp\B853.tmp"75⤵PID:1512
-
C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"C:\Users\Admin\AppData\Local\Temp\B8C1.tmp"76⤵PID:996
-
C:\Users\Admin\AppData\Local\Temp\B94D.tmp"C:\Users\Admin\AppData\Local\Temp\B94D.tmp"77⤵PID:3592
-
C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"C:\Users\Admin\AppData\Local\Temp\B9DA.tmp"78⤵PID:3896
-
C:\Users\Admin\AppData\Local\Temp\BA47.tmp"C:\Users\Admin\AppData\Local\Temp\BA47.tmp"79⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"C:\Users\Admin\AppData\Local\Temp\BAB5.tmp"80⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\BB41.tmp"C:\Users\Admin\AppData\Local\Temp\BB41.tmp"81⤵PID:1664
-
C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"C:\Users\Admin\AppData\Local\Temp\BC3B.tmp"82⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"C:\Users\Admin\AppData\Local\Temp\BCA9.tmp"83⤵PID:780
-
C:\Users\Admin\AppData\Local\Temp\BD35.tmp"C:\Users\Admin\AppData\Local\Temp\BD35.tmp"84⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"C:\Users\Admin\AppData\Local\Temp\BDA3.tmp"85⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\BE10.tmp"C:\Users\Admin\AppData\Local\Temp\BE10.tmp"86⤵PID:3540
-
C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"C:\Users\Admin\AppData\Local\Temp\BE8D.tmp"87⤵PID:1900
-
C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"C:\Users\Admin\AppData\Local\Temp\BF0A.tmp"88⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\BF97.tmp"C:\Users\Admin\AppData\Local\Temp\BF97.tmp"89⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\C033.tmp"C:\Users\Admin\AppData\Local\Temp\C033.tmp"90⤵PID:392
-
C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"C:\Users\Admin\AppData\Local\Temp\C0C0.tmp"91⤵PID:3052
-
C:\Users\Admin\AppData\Local\Temp\C12D.tmp"C:\Users\Admin\AppData\Local\Temp\C12D.tmp"92⤵PID:2180
-
C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"C:\Users\Admin\AppData\Local\Temp\C1C9.tmp"93⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\C246.tmp"C:\Users\Admin\AppData\Local\Temp\C246.tmp"94⤵PID:1656
-
C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"C:\Users\Admin\AppData\Local\Temp\C2C3.tmp"95⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\C35F.tmp"C:\Users\Admin\AppData\Local\Temp\C35F.tmp"96⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"C:\Users\Admin\AppData\Local\Temp\C3CD.tmp"97⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\C459.tmp"C:\Users\Admin\AppData\Local\Temp\C459.tmp"98⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"C:\Users\Admin\AppData\Local\Temp\C4C7.tmp"99⤵PID:2944
-
C:\Users\Admin\AppData\Local\Temp\C553.tmp"C:\Users\Admin\AppData\Local\Temp\C553.tmp"100⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"C:\Users\Admin\AppData\Local\Temp\C5C1.tmp"101⤵PID:5064
-
C:\Users\Admin\AppData\Local\Temp\C61F.tmp"C:\Users\Admin\AppData\Local\Temp\C61F.tmp"102⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"C:\Users\Admin\AppData\Local\Temp\C6AB.tmp"103⤵PID:2908
-
C:\Users\Admin\AppData\Local\Temp\C738.tmp"C:\Users\Admin\AppData\Local\Temp\C738.tmp"104⤵PID:1808
-
C:\Users\Admin\AppData\Local\Temp\C796.tmp"C:\Users\Admin\AppData\Local\Temp\C796.tmp"105⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\C803.tmp"C:\Users\Admin\AppData\Local\Temp\C803.tmp"106⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\C880.tmp"C:\Users\Admin\AppData\Local\Temp\C880.tmp"107⤵PID:4696
-
C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"C:\Users\Admin\AppData\Local\Temp\C8ED.tmp"108⤵PID:4576
-
C:\Users\Admin\AppData\Local\Temp\C98A.tmp"C:\Users\Admin\AppData\Local\Temp\C98A.tmp"109⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\CA07.tmp"C:\Users\Admin\AppData\Local\Temp\CA07.tmp"110⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\CA84.tmp"C:\Users\Admin\AppData\Local\Temp\CA84.tmp"111⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\CB10.tmp"C:\Users\Admin\AppData\Local\Temp\CB10.tmp"112⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"C:\Users\Admin\AppData\Local\Temp\CBBC.tmp"113⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\CC49.tmp"C:\Users\Admin\AppData\Local\Temp\CC49.tmp"114⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"C:\Users\Admin\AppData\Local\Temp\CCC6.tmp"115⤵PID:4088
-
C:\Users\Admin\AppData\Local\Temp\CD43.tmp"C:\Users\Admin\AppData\Local\Temp\CD43.tmp"116⤵PID:636
-
C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"C:\Users\Admin\AppData\Local\Temp\CDCF.tmp"117⤵PID:944
-
C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"C:\Users\Admin\AppData\Local\Temp\CE4C.tmp"118⤵PID:4000
-
C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"C:\Users\Admin\AppData\Local\Temp\CEBA.tmp"119⤵PID:2028
-
C:\Users\Admin\AppData\Local\Temp\CF46.tmp"C:\Users\Admin\AppData\Local\Temp\CF46.tmp"120⤵PID:2544
-
C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"C:\Users\Admin\AppData\Local\Temp\CFB4.tmp"121⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\D031.tmp"C:\Users\Admin\AppData\Local\Temp\D031.tmp"122⤵PID:1352
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-