Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 23:09
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe
Resource
win10v2004-20231025-en
General
-
Target
NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe
-
Size
486KB
-
MD5
3ef7d684b7420782500392affb91ef35
-
SHA1
4b08426de23fc7c4b2c6a8c721dfad940c358901
-
SHA256
f61853934f94da53d93ab446cac6b415a4546896979746ee6deb25fc87fcb6d5
-
SHA512
c7b9449664271e43cd44f4f442da4b6af626dac508d89b758dbe0a203d459d1d1177a9fda3307508b54c46a5f5a8174077ccfb0e1d01391125e1af5188f538c4
-
SSDEEP
6144:Sorf3lPvovsgZnqG2C7mOTeiLfD7IU5qkkdUj8mgKWHDR0iHNBKutpoVxJfsH3dZ:/U5rCOTeiDIC4mAHN0iHLKu3SCNZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3272 691A.tmp 1616 69D6.tmp 2616 6A81.tmp 60 6B0E.tmp 3540 6B9B.tmp 4632 6C47.tmp 4624 6CE3.tmp 4992 6D7F.tmp 4472 6E3B.tmp 5028 6EF6.tmp 3392 6FA2.tmp 4816 705D.tmp 4532 70FA.tmp 2940 7271.tmp 4672 730D.tmp 1488 73C8.tmp 2720 7455.tmp 628 74E2.tmp 1824 755F.tmp 752 761A.tmp 3816 76E5.tmp 2180 7782.tmp 4528 783D.tmp 2856 7927.tmp 364 79F3.tmp 2052 7AAE.tmp 3416 7B5A.tmp 1552 7C06.tmp 5076 7CF0.tmp 1292 7DEA.tmp 4948 7EB5.tmp 4308 7F71.tmp 4564 804C.tmp 4464 80D8.tmp 2252 81C3.tmp 4432 8240.tmp 2056 82BD.tmp 1832 833A.tmp 3448 83B7.tmp 1076 8443.tmp 960 84C0.tmp 3744 854D.tmp 3556 85E9.tmp 4824 8676.tmp 1676 8712.tmp 3120 879F.tmp 1176 882B.tmp 3540 88C7.tmp 2696 8964.tmp 4728 89E1.tmp 3560 8A5E.tmp 4512 8AEA.tmp 3752 8BD5.tmp 2784 8C61.tmp 4452 8CDE.tmp 4344 8D6B.tmp 4136 8DE8.tmp 2276 8E75.tmp 1524 8F01.tmp 4532 8FAD.tmp 4240 9049.tmp 3512 90F5.tmp 4784 91B1.tmp 2420 925D.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1832 wrote to memory of 3272 1832 NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe 87 PID 1832 wrote to memory of 3272 1832 NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe 87 PID 1832 wrote to memory of 3272 1832 NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe 87 PID 3272 wrote to memory of 1616 3272 691A.tmp 89 PID 3272 wrote to memory of 1616 3272 691A.tmp 89 PID 3272 wrote to memory of 1616 3272 691A.tmp 89 PID 1616 wrote to memory of 2616 1616 69D6.tmp 91 PID 1616 wrote to memory of 2616 1616 69D6.tmp 91 PID 1616 wrote to memory of 2616 1616 69D6.tmp 91 PID 2616 wrote to memory of 60 2616 6A81.tmp 92 PID 2616 wrote to memory of 60 2616 6A81.tmp 92 PID 2616 wrote to memory of 60 2616 6A81.tmp 92 PID 60 wrote to memory of 3540 60 6B0E.tmp 93 PID 60 wrote to memory of 3540 60 6B0E.tmp 93 PID 60 wrote to memory of 3540 60 6B0E.tmp 93 PID 3540 wrote to memory of 4632 3540 6B9B.tmp 95 PID 3540 wrote to memory of 4632 3540 6B9B.tmp 95 PID 3540 wrote to memory of 4632 3540 6B9B.tmp 95 PID 4632 wrote to memory of 4624 4632 6C47.tmp 96 PID 4632 wrote to memory of 4624 4632 6C47.tmp 96 PID 4632 wrote to memory of 4624 4632 6C47.tmp 96 PID 4624 wrote to memory of 4992 4624 6CE3.tmp 97 PID 4624 wrote to memory of 4992 4624 6CE3.tmp 97 PID 4624 wrote to memory of 4992 4624 6CE3.tmp 97 PID 4992 wrote to memory of 4472 4992 6D7F.tmp 98 PID 4992 wrote to memory of 4472 4992 6D7F.tmp 98 PID 4992 wrote to memory of 4472 4992 6D7F.tmp 98 PID 4472 wrote to memory of 5028 4472 6E3B.tmp 99 PID 4472 wrote to memory of 5028 4472 6E3B.tmp 99 PID 4472 wrote to memory of 5028 4472 6E3B.tmp 99 PID 5028 wrote to memory of 3392 5028 6EF6.tmp 100 PID 5028 wrote to memory of 3392 5028 6EF6.tmp 100 PID 5028 wrote to memory of 3392 5028 6EF6.tmp 100 PID 3392 wrote to memory of 4816 3392 6FA2.tmp 101 PID 3392 wrote to memory of 4816 3392 6FA2.tmp 101 PID 3392 wrote to memory of 4816 3392 6FA2.tmp 101 PID 4816 wrote to memory of 4532 4816 705D.tmp 103 PID 4816 wrote to memory of 4532 4816 705D.tmp 103 PID 4816 wrote to memory of 4532 4816 705D.tmp 103 PID 4532 wrote to memory of 2940 4532 70FA.tmp 104 PID 4532 wrote to memory of 2940 4532 70FA.tmp 104 PID 4532 wrote to memory of 2940 4532 70FA.tmp 104 PID 2940 wrote to memory of 4672 2940 7271.tmp 105 PID 2940 wrote to memory of 4672 2940 7271.tmp 105 PID 2940 wrote to memory of 4672 2940 7271.tmp 105 PID 4672 wrote to memory of 1488 4672 730D.tmp 107 PID 4672 wrote to memory of 1488 4672 730D.tmp 107 PID 4672 wrote to memory of 1488 4672 730D.tmp 107 PID 1488 wrote to memory of 2720 1488 73C8.tmp 108 PID 1488 wrote to memory of 2720 1488 73C8.tmp 108 PID 1488 wrote to memory of 2720 1488 73C8.tmp 108 PID 2720 wrote to memory of 628 2720 7455.tmp 109 PID 2720 wrote to memory of 628 2720 7455.tmp 109 PID 2720 wrote to memory of 628 2720 7455.tmp 109 PID 628 wrote to memory of 1824 628 74E2.tmp 110 PID 628 wrote to memory of 1824 628 74E2.tmp 110 PID 628 wrote to memory of 1824 628 74E2.tmp 110 PID 1824 wrote to memory of 752 1824 755F.tmp 111 PID 1824 wrote to memory of 752 1824 755F.tmp 111 PID 1824 wrote to memory of 752 1824 755F.tmp 111 PID 752 wrote to memory of 3816 752 761A.tmp 112 PID 752 wrote to memory of 3816 752 761A.tmp 112 PID 752 wrote to memory of 3816 752 761A.tmp 112 PID 3816 wrote to memory of 2180 3816 76E5.tmp 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_3ef7d684b7420782500392affb91ef35_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3272 -
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\6A81.tmp"C:\Users\Admin\AppData\Local\Temp\6A81.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2616 -
C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"C:\Users\Admin\AppData\Local\Temp\6B0E.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:60 -
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\6C47.tmp"C:\Users\Admin\AppData\Local\Temp\6C47.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4624 -
C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"C:\Users\Admin\AppData\Local\Temp\6D7F.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4992 -
C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"C:\Users\Admin\AppData\Local\Temp\6E3B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4472 -
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5028 -
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Users\Admin\AppData\Local\Temp\705D.tmp"C:\Users\Admin\AppData\Local\Temp\705D.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\70FA.tmp"C:\Users\Admin\AppData\Local\Temp\70FA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\7271.tmp"C:\Users\Admin\AppData\Local\Temp\7271.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Users\Admin\AppData\Local\Temp\730D.tmp"C:\Users\Admin\AppData\Local\Temp\730D.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4672 -
C:\Users\Admin\AppData\Local\Temp\73C8.tmp"C:\Users\Admin\AppData\Local\Temp\73C8.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\7455.tmp"C:\Users\Admin\AppData\Local\Temp\7455.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\74E2.tmp"C:\Users\Admin\AppData\Local\Temp\74E2.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\755F.tmp"C:\Users\Admin\AppData\Local\Temp\755F.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\761A.tmp"C:\Users\Admin\AppData\Local\Temp\761A.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\76E5.tmp"C:\Users\Admin\AppData\Local\Temp\76E5.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\7782.tmp"C:\Users\Admin\AppData\Local\Temp\7782.tmp"23⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\783D.tmp"C:\Users\Admin\AppData\Local\Temp\783D.tmp"24⤵
- Executes dropped EXE
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\7927.tmp"C:\Users\Admin\AppData\Local\Temp\7927.tmp"25⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\79F3.tmp"C:\Users\Admin\AppData\Local\Temp\79F3.tmp"26⤵
- Executes dropped EXE
PID:364 -
C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"C:\Users\Admin\AppData\Local\Temp\7AAE.tmp"27⤵
- Executes dropped EXE
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"C:\Users\Admin\AppData\Local\Temp\7B5A.tmp"28⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\7C06.tmp"C:\Users\Admin\AppData\Local\Temp\7C06.tmp"29⤵
- Executes dropped EXE
PID:1552 -
C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"C:\Users\Admin\AppData\Local\Temp\7CF0.tmp"30⤵
- Executes dropped EXE
PID:5076 -
C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"C:\Users\Admin\AppData\Local\Temp\7DEA.tmp"31⤵
- Executes dropped EXE
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"C:\Users\Admin\AppData\Local\Temp\7EB5.tmp"32⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\7F71.tmp"C:\Users\Admin\AppData\Local\Temp\7F71.tmp"33⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\804C.tmp"C:\Users\Admin\AppData\Local\Temp\804C.tmp"34⤵
- Executes dropped EXE
PID:4564 -
C:\Users\Admin\AppData\Local\Temp\80D8.tmp"C:\Users\Admin\AppData\Local\Temp\80D8.tmp"35⤵
- Executes dropped EXE
PID:4464 -
C:\Users\Admin\AppData\Local\Temp\8155.tmp"C:\Users\Admin\AppData\Local\Temp\8155.tmp"36⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\81C3.tmp"C:\Users\Admin\AppData\Local\Temp\81C3.tmp"37⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\8240.tmp"C:\Users\Admin\AppData\Local\Temp\8240.tmp"38⤵
- Executes dropped EXE
PID:4432 -
C:\Users\Admin\AppData\Local\Temp\82BD.tmp"C:\Users\Admin\AppData\Local\Temp\82BD.tmp"39⤵
- Executes dropped EXE
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\833A.tmp"C:\Users\Admin\AppData\Local\Temp\833A.tmp"40⤵
- Executes dropped EXE
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\83B7.tmp"C:\Users\Admin\AppData\Local\Temp\83B7.tmp"41⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\8443.tmp"C:\Users\Admin\AppData\Local\Temp\8443.tmp"42⤵
- Executes dropped EXE
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\84C0.tmp"C:\Users\Admin\AppData\Local\Temp\84C0.tmp"43⤵
- Executes dropped EXE
PID:960 -
C:\Users\Admin\AppData\Local\Temp\854D.tmp"C:\Users\Admin\AppData\Local\Temp\854D.tmp"44⤵
- Executes dropped EXE
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\85E9.tmp"C:\Users\Admin\AppData\Local\Temp\85E9.tmp"45⤵
- Executes dropped EXE
PID:3556 -
C:\Users\Admin\AppData\Local\Temp\8676.tmp"C:\Users\Admin\AppData\Local\Temp\8676.tmp"46⤵
- Executes dropped EXE
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\8712.tmp"C:\Users\Admin\AppData\Local\Temp\8712.tmp"47⤵
- Executes dropped EXE
PID:1676 -
C:\Users\Admin\AppData\Local\Temp\879F.tmp"C:\Users\Admin\AppData\Local\Temp\879F.tmp"48⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\882B.tmp"C:\Users\Admin\AppData\Local\Temp\882B.tmp"49⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\88C7.tmp"C:\Users\Admin\AppData\Local\Temp\88C7.tmp"50⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\8964.tmp"C:\Users\Admin\AppData\Local\Temp\8964.tmp"51⤵
- Executes dropped EXE
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\89E1.tmp"C:\Users\Admin\AppData\Local\Temp\89E1.tmp"52⤵
- Executes dropped EXE
PID:4728 -
C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"C:\Users\Admin\AppData\Local\Temp\8A5E.tmp"53⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"C:\Users\Admin\AppData\Local\Temp\8AEA.tmp"54⤵
- Executes dropped EXE
PID:4512 -
C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"C:\Users\Admin\AppData\Local\Temp\8BD5.tmp"55⤵
- Executes dropped EXE
PID:3752 -
C:\Users\Admin\AppData\Local\Temp\8C61.tmp"C:\Users\Admin\AppData\Local\Temp\8C61.tmp"56⤵
- Executes dropped EXE
PID:2784 -
C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"C:\Users\Admin\AppData\Local\Temp\8CDE.tmp"57⤵
- Executes dropped EXE
PID:4452 -
C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"C:\Users\Admin\AppData\Local\Temp\8D6B.tmp"58⤵
- Executes dropped EXE
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"C:\Users\Admin\AppData\Local\Temp\8DE8.tmp"59⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\8E75.tmp"C:\Users\Admin\AppData\Local\Temp\8E75.tmp"60⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\8F01.tmp"C:\Users\Admin\AppData\Local\Temp\8F01.tmp"61⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"C:\Users\Admin\AppData\Local\Temp\8FAD.tmp"62⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\9049.tmp"C:\Users\Admin\AppData\Local\Temp\9049.tmp"63⤵
- Executes dropped EXE
PID:4240 -
C:\Users\Admin\AppData\Local\Temp\90F5.tmp"C:\Users\Admin\AppData\Local\Temp\90F5.tmp"64⤵
- Executes dropped EXE
PID:3512 -
C:\Users\Admin\AppData\Local\Temp\91B1.tmp"C:\Users\Admin\AppData\Local\Temp\91B1.tmp"65⤵
- Executes dropped EXE
PID:4784 -
C:\Users\Admin\AppData\Local\Temp\925D.tmp"C:\Users\Admin\AppData\Local\Temp\925D.tmp"66⤵
- Executes dropped EXE
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\9308.tmp"C:\Users\Admin\AppData\Local\Temp\9308.tmp"67⤵PID:556
-
C:\Users\Admin\AppData\Local\Temp\9395.tmp"C:\Users\Admin\AppData\Local\Temp\9395.tmp"68⤵PID:64
-
C:\Users\Admin\AppData\Local\Temp\9422.tmp"C:\Users\Admin\AppData\Local\Temp\9422.tmp"69⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\94AE.tmp"C:\Users\Admin\AppData\Local\Temp\94AE.tmp"70⤵PID:3300
-
C:\Users\Admin\AppData\Local\Temp\953B.tmp"C:\Users\Admin\AppData\Local\Temp\953B.tmp"71⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\95C8.tmp"C:\Users\Admin\AppData\Local\Temp\95C8.tmp"72⤵PID:848
-
C:\Users\Admin\AppData\Local\Temp\9645.tmp"C:\Users\Admin\AppData\Local\Temp\9645.tmp"73⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\96E1.tmp"C:\Users\Admin\AppData\Local\Temp\96E1.tmp"74⤵PID:4032
-
C:\Users\Admin\AppData\Local\Temp\975E.tmp"C:\Users\Admin\AppData\Local\Temp\975E.tmp"75⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\97EA.tmp"C:\Users\Admin\AppData\Local\Temp\97EA.tmp"76⤵PID:4528
-
C:\Users\Admin\AppData\Local\Temp\9877.tmp"C:\Users\Admin\AppData\Local\Temp\9877.tmp"77⤵PID:2856
-
C:\Users\Admin\AppData\Local\Temp\9904.tmp"C:\Users\Admin\AppData\Local\Temp\9904.tmp"78⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\9971.tmp"C:\Users\Admin\AppData\Local\Temp\9971.tmp"79⤵PID:1980
-
C:\Users\Admin\AppData\Local\Temp\99FE.tmp"C:\Users\Admin\AppData\Local\Temp\99FE.tmp"80⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"C:\Users\Admin\AppData\Local\Temp\9A9A.tmp"81⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\9B07.tmp"C:\Users\Admin\AppData\Local\Temp\9B07.tmp"82⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\9B75.tmp"C:\Users\Admin\AppData\Local\Temp\9B75.tmp"83⤵PID:4496
-
C:\Users\Admin\AppData\Local\Temp\9C30.tmp"C:\Users\Admin\AppData\Local\Temp\9C30.tmp"84⤵PID:3684
-
C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"C:\Users\Admin\AppData\Local\Temp\9CAD.tmp"85⤵PID:2480
-
C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"C:\Users\Admin\AppData\Local\Temp\9D3A.tmp"86⤵PID:3660
-
C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"C:\Users\Admin\AppData\Local\Temp\9DA7.tmp"87⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\9E24.tmp"C:\Users\Admin\AppData\Local\Temp\9E24.tmp"88⤵PID:672
-
C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"C:\Users\Admin\AppData\Local\Temp\9EA1.tmp"89⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"C:\Users\Admin\AppData\Local\Temp\9F1E.tmp"90⤵PID:1132
-
C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"C:\Users\Admin\AppData\Local\Temp\9F8C.tmp"91⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\A028.tmp"C:\Users\Admin\AppData\Local\Temp\A028.tmp"92⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"C:\Users\Admin\AppData\Local\Temp\A0A5.tmp"93⤵PID:448
-
C:\Users\Admin\AppData\Local\Temp\A112.tmp"C:\Users\Admin\AppData\Local\Temp\A112.tmp"94⤵PID:1600
-
C:\Users\Admin\AppData\Local\Temp\A180.tmp"C:\Users\Admin\AppData\Local\Temp\A180.tmp"95⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\A21C.tmp"C:\Users\Admin\AppData\Local\Temp\A21C.tmp"96⤵PID:1324
-
C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"C:\Users\Admin\AppData\Local\Temp\A2A8.tmp"97⤵PID:3680
-
C:\Users\Admin\AppData\Local\Temp\A316.tmp"C:\Users\Admin\AppData\Local\Temp\A316.tmp"98⤵PID:948
-
C:\Users\Admin\AppData\Local\Temp\A393.tmp"C:\Users\Admin\AppData\Local\Temp\A393.tmp"99⤵PID:1360
-
C:\Users\Admin\AppData\Local\Temp\A41F.tmp"C:\Users\Admin\AppData\Local\Temp\A41F.tmp"100⤵PID:1616
-
C:\Users\Admin\AppData\Local\Temp\A49C.tmp"C:\Users\Admin\AppData\Local\Temp\A49C.tmp"101⤵PID:1148
-
C:\Users\Admin\AppData\Local\Temp\A519.tmp"C:\Users\Admin\AppData\Local\Temp\A519.tmp"102⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\A577.tmp"C:\Users\Admin\AppData\Local\Temp\A577.tmp"103⤵PID:2616
-
C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"C:\Users\Admin\AppData\Local\Temp\A5E5.tmp"104⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\A662.tmp"C:\Users\Admin\AppData\Local\Temp\A662.tmp"105⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"C:\Users\Admin\AppData\Local\Temp\A6BF.tmp"106⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\A74C.tmp"C:\Users\Admin\AppData\Local\Temp\A74C.tmp"107⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"C:\Users\Admin\AppData\Local\Temp\A7E8.tmp"108⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\A865.tmp"C:\Users\Admin\AppData\Local\Temp\A865.tmp"109⤵PID:2628
-
C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"C:\Users\Admin\AppData\Local\Temp\A8E2.tmp"110⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\A95F.tmp"C:\Users\Admin\AppData\Local\Temp\A95F.tmp"111⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"C:\Users\Admin\AppData\Local\Temp\A9EC.tmp"112⤵PID:1776
-
C:\Users\Admin\AppData\Local\Temp\AA59.tmp"C:\Users\Admin\AppData\Local\Temp\AA59.tmp"113⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"C:\Users\Admin\AppData\Local\Temp\AAB7.tmp"114⤵PID:4800
-
C:\Users\Admin\AppData\Local\Temp\AB34.tmp"C:\Users\Admin\AppData\Local\Temp\AB34.tmp"115⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"C:\Users\Admin\AppData\Local\Temp\ABB1.tmp"116⤵PID:1180
-
C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"C:\Users\Admin\AppData\Local\Temp\AC2E.tmp"117⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"C:\Users\Admin\AppData\Local\Temp\ACAB.tmp"118⤵PID:5028
-
C:\Users\Admin\AppData\Local\Temp\AD18.tmp"C:\Users\Admin\AppData\Local\Temp\AD18.tmp"119⤵PID:2868
-
C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"C:\Users\Admin\AppData\Local\Temp\ADA5.tmp"120⤵PID:4584
-
C:\Users\Admin\AppData\Local\Temp\AE22.tmp"C:\Users\Admin\AppData\Local\Temp\AE22.tmp"121⤵PID:4816
-
C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"C:\Users\Admin\AppData\Local\Temp\AE9F.tmp"122⤵PID:2080
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-