Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 10:24
Static task
static1
Behavioral task
behavioral1
Sample
c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe
-
Size
486KB
-
MD5
c2c727878ffc2a4084463df1b700cc60
-
SHA1
3443d96529203306d90bc78f7830b98a8fc1f761
-
SHA256
67bb68d14537942b1574bae2a5dc63fa4405555aa63201df92bd40a6b0390397
-
SHA512
ce7447cfc11aa77dd77f539896ac123554ea89432ae4e82be104b1a0407b1780e57c10d54d421b5063703480f5c8154928fd6acd6c412b702cd847cd81b4c351
-
SSDEEP
12288:/U5rCOTeiDVnKLhewNojIBj7/vw2RTfIrR1NZ:/UQOJDVnK9eoj7waTyR1N
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2344 4239.tmp 3184 42C6.tmp 3116 4352.tmp 4720 43DF.tmp 3320 444C.tmp 1460 44BA.tmp 4052 4517.tmp 4592 4575.tmp 2612 45E2.tmp 4596 4650.tmp 1688 469E.tmp 4212 46FC.tmp 4528 4759.tmp 2264 47B7.tmp 1168 4825.tmp 3516 48A2.tmp 1040 491F.tmp 1268 496D.tmp 2700 49CA.tmp 5080 4A28.tmp 3756 4A76.tmp 2136 4AD4.tmp 1440 4B22.tmp 2276 4B9F.tmp 1572 4BED.tmp 1172 4C6A.tmp 1752 4CD8.tmp 3360 4D35.tmp 1908 4D93.tmp 2756 4E20.tmp 4172 4E7E.tmp 1632 4EEB.tmp 3020 4F58.tmp 2008 4FA6.tmp 4308 5004.tmp 4556 5062.tmp 1692 50B0.tmp 3932 511D.tmp 4420 516C.tmp 4352 51BA.tmp 4320 5208.tmp 4084 5256.tmp 3128 52A4.tmp 1792 52F2.tmp 4524 5340.tmp 3912 538E.tmp 5100 53DD.tmp 2524 543A.tmp 1032 5488.tmp 3088 54E6.tmp 2316 5544.tmp 3576 5592.tmp 3068 55E0.tmp 4948 563E.tmp 1984 569C.tmp 1348 56F9.tmp 3788 5757.tmp 2284 57A5.tmp 3864 57F3.tmp 4364 5842.tmp 3600 5890.tmp 3984 58DE.tmp 1304 593C.tmp 2856 5999.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4448 wrote to memory of 2344 4448 c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe 82 PID 4448 wrote to memory of 2344 4448 c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe 82 PID 4448 wrote to memory of 2344 4448 c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe 82 PID 2344 wrote to memory of 3184 2344 4239.tmp 83 PID 2344 wrote to memory of 3184 2344 4239.tmp 83 PID 2344 wrote to memory of 3184 2344 4239.tmp 83 PID 3184 wrote to memory of 3116 3184 42C6.tmp 85 PID 3184 wrote to memory of 3116 3184 42C6.tmp 85 PID 3184 wrote to memory of 3116 3184 42C6.tmp 85 PID 3116 wrote to memory of 4720 3116 4352.tmp 86 PID 3116 wrote to memory of 4720 3116 4352.tmp 86 PID 3116 wrote to memory of 4720 3116 4352.tmp 86 PID 4720 wrote to memory of 3320 4720 43DF.tmp 88 PID 4720 wrote to memory of 3320 4720 43DF.tmp 88 PID 4720 wrote to memory of 3320 4720 43DF.tmp 88 PID 3320 wrote to memory of 1460 3320 444C.tmp 89 PID 3320 wrote to memory of 1460 3320 444C.tmp 89 PID 3320 wrote to memory of 1460 3320 444C.tmp 89 PID 1460 wrote to memory of 4052 1460 44BA.tmp 90 PID 1460 wrote to memory of 4052 1460 44BA.tmp 90 PID 1460 wrote to memory of 4052 1460 44BA.tmp 90 PID 4052 wrote to memory of 4592 4052 4517.tmp 91 PID 4052 wrote to memory of 4592 4052 4517.tmp 91 PID 4052 wrote to memory of 4592 4052 4517.tmp 91 PID 4592 wrote to memory of 2612 4592 4575.tmp 92 PID 4592 wrote to memory of 2612 4592 4575.tmp 92 PID 4592 wrote to memory of 2612 4592 4575.tmp 92 PID 2612 wrote to memory of 4596 2612 45E2.tmp 93 PID 2612 wrote to memory of 4596 2612 45E2.tmp 93 PID 2612 wrote to memory of 4596 2612 45E2.tmp 93 PID 4596 wrote to memory of 1688 4596 4650.tmp 94 PID 4596 wrote to memory of 1688 4596 4650.tmp 94 PID 4596 wrote to memory of 1688 4596 4650.tmp 94 PID 1688 wrote to memory of 4212 1688 469E.tmp 95 PID 1688 wrote to memory of 4212 1688 469E.tmp 95 PID 1688 wrote to memory of 4212 1688 469E.tmp 95 PID 4212 wrote to memory of 4528 4212 46FC.tmp 96 PID 4212 wrote to memory of 4528 4212 46FC.tmp 96 PID 4212 wrote to memory of 4528 4212 46FC.tmp 96 PID 4528 wrote to memory of 2264 4528 4759.tmp 97 PID 4528 wrote to memory of 2264 4528 4759.tmp 97 PID 4528 wrote to memory of 2264 4528 4759.tmp 97 PID 2264 wrote to memory of 1168 2264 47B7.tmp 98 PID 2264 wrote to memory of 1168 2264 47B7.tmp 98 PID 2264 wrote to memory of 1168 2264 47B7.tmp 98 PID 1168 wrote to memory of 3516 1168 4825.tmp 99 PID 1168 wrote to memory of 3516 1168 4825.tmp 99 PID 1168 wrote to memory of 3516 1168 4825.tmp 99 PID 3516 wrote to memory of 1040 3516 48A2.tmp 100 PID 3516 wrote to memory of 1040 3516 48A2.tmp 100 PID 3516 wrote to memory of 1040 3516 48A2.tmp 100 PID 1040 wrote to memory of 1268 1040 491F.tmp 101 PID 1040 wrote to memory of 1268 1040 491F.tmp 101 PID 1040 wrote to memory of 1268 1040 491F.tmp 101 PID 1268 wrote to memory of 2700 1268 496D.tmp 102 PID 1268 wrote to memory of 2700 1268 496D.tmp 102 PID 1268 wrote to memory of 2700 1268 496D.tmp 102 PID 2700 wrote to memory of 5080 2700 49CA.tmp 103 PID 2700 wrote to memory of 5080 2700 49CA.tmp 103 PID 2700 wrote to memory of 5080 2700 49CA.tmp 103 PID 5080 wrote to memory of 3756 5080 4A28.tmp 104 PID 5080 wrote to memory of 3756 5080 4A28.tmp 104 PID 5080 wrote to memory of 3756 5080 4A28.tmp 104 PID 3756 wrote to memory of 2136 3756 4A76.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\c2c727878ffc2a4084463df1b700cc60_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4448 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3320 -
C:\Users\Admin\AppData\Local\Temp\44BA.tmp"C:\Users\Admin\AppData\Local\Temp\44BA.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\4517.tmp"C:\Users\Admin\AppData\Local\Temp\4517.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Users\Admin\AppData\Local\Temp\4575.tmp"C:\Users\Admin\AppData\Local\Temp\4575.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\Users\Admin\AppData\Local\Temp\469E.tmp"C:\Users\Admin\AppData\Local\Temp\469E.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1168 -
C:\Users\Admin\AppData\Local\Temp\48A2.tmp"C:\Users\Admin\AppData\Local\Temp\48A2.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1040 -
C:\Users\Admin\AppData\Local\Temp\496D.tmp"C:\Users\Admin\AppData\Local\Temp\496D.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4A76.tmp"C:\Users\Admin\AppData\Local\Temp\4A76.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"C:\Users\Admin\AppData\Local\Temp\4AD4.tmp"23⤵
- Executes dropped EXE
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"24⤵
- Executes dropped EXE
PID:1440 -
C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"C:\Users\Admin\AppData\Local\Temp\4B9F.tmp"25⤵
- Executes dropped EXE
PID:2276 -
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"26⤵
- Executes dropped EXE
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"C:\Users\Admin\AppData\Local\Temp\4C6A.tmp"27⤵
- Executes dropped EXE
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"28⤵
- Executes dropped EXE
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"29⤵
- Executes dropped EXE
PID:3360 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"30⤵
- Executes dropped EXE
PID:1908 -
C:\Users\Admin\AppData\Local\Temp\4E20.tmp"C:\Users\Admin\AppData\Local\Temp\4E20.tmp"31⤵
- Executes dropped EXE
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"C:\Users\Admin\AppData\Local\Temp\4E7E.tmp"32⤵
- Executes dropped EXE
PID:4172 -
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"33⤵
- Executes dropped EXE
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"34⤵
- Executes dropped EXE
PID:3020 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"35⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"36⤵
- Executes dropped EXE
PID:4308 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"37⤵
- Executes dropped EXE
PID:4556 -
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"38⤵
- Executes dropped EXE
PID:1692 -
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"39⤵
- Executes dropped EXE
PID:3932 -
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"40⤵
- Executes dropped EXE
PID:4420 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"41⤵
- Executes dropped EXE
PID:4352 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"42⤵
- Executes dropped EXE
PID:4320 -
C:\Users\Admin\AppData\Local\Temp\5256.tmp"C:\Users\Admin\AppData\Local\Temp\5256.tmp"43⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"44⤵
- Executes dropped EXE
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\52F2.tmp"C:\Users\Admin\AppData\Local\Temp\52F2.tmp"45⤵
- Executes dropped EXE
PID:1792 -
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"46⤵
- Executes dropped EXE
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\538E.tmp"C:\Users\Admin\AppData\Local\Temp\538E.tmp"47⤵
- Executes dropped EXE
PID:3912 -
C:\Users\Admin\AppData\Local\Temp\53DD.tmp"C:\Users\Admin\AppData\Local\Temp\53DD.tmp"48⤵
- Executes dropped EXE
PID:5100 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"49⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"50⤵
- Executes dropped EXE
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"51⤵
- Executes dropped EXE
PID:3088 -
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"52⤵
- Executes dropped EXE
PID:2316 -
C:\Users\Admin\AppData\Local\Temp\5592.tmp"C:\Users\Admin\AppData\Local\Temp\5592.tmp"53⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"54⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\563E.tmp"C:\Users\Admin\AppData\Local\Temp\563E.tmp"55⤵
- Executes dropped EXE
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\569C.tmp"C:\Users\Admin\AppData\Local\Temp\569C.tmp"56⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\56F9.tmp"C:\Users\Admin\AppData\Local\Temp\56F9.tmp"57⤵
- Executes dropped EXE
PID:1348 -
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"58⤵
- Executes dropped EXE
PID:3788 -
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"59⤵
- Executes dropped EXE
PID:2284 -
C:\Users\Admin\AppData\Local\Temp\57F3.tmp"C:\Users\Admin\AppData\Local\Temp\57F3.tmp"60⤵
- Executes dropped EXE
PID:3864 -
C:\Users\Admin\AppData\Local\Temp\5842.tmp"C:\Users\Admin\AppData\Local\Temp\5842.tmp"61⤵
- Executes dropped EXE
PID:4364 -
C:\Users\Admin\AppData\Local\Temp\5890.tmp"C:\Users\Admin\AppData\Local\Temp\5890.tmp"62⤵
- Executes dropped EXE
PID:3600 -
C:\Users\Admin\AppData\Local\Temp\58DE.tmp"C:\Users\Admin\AppData\Local\Temp\58DE.tmp"63⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\593C.tmp"C:\Users\Admin\AppData\Local\Temp\593C.tmp"64⤵
- Executes dropped EXE
PID:1304 -
C:\Users\Admin\AppData\Local\Temp\5999.tmp"C:\Users\Admin\AppData\Local\Temp\5999.tmp"65⤵
- Executes dropped EXE
PID:2856 -
C:\Users\Admin\AppData\Local\Temp\59E7.tmp"C:\Users\Admin\AppData\Local\Temp\59E7.tmp"66⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\5A45.tmp"C:\Users\Admin\AppData\Local\Temp\5A45.tmp"67⤵PID:1216
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"68⤵PID:2812
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"69⤵PID:4284
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"70⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"71⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"72⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"C:\Users\Admin\AppData\Local\Temp\5C2A.tmp"73⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5C78.tmp"C:\Users\Admin\AppData\Local\Temp\5C78.tmp"74⤵PID:400
-
C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"C:\Users\Admin\AppData\Local\Temp\5CC6.tmp"75⤵PID:2348
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"76⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"77⤵PID:4996
-
C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"C:\Users\Admin\AppData\Local\Temp\5DB0.tmp"78⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"C:\Users\Admin\AppData\Local\Temp\5DFE.tmp"79⤵PID:4260
-
C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"C:\Users\Admin\AppData\Local\Temp\5E4C.tmp"80⤵PID:2568
-
C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"C:\Users\Admin\AppData\Local\Temp\5E9B.tmp"81⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"C:\Users\Admin\AppData\Local\Temp\5EE9.tmp"82⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\5F37.tmp"C:\Users\Admin\AppData\Local\Temp\5F37.tmp"83⤵PID:4748
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"84⤵PID:4956
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"85⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\6031.tmp"C:\Users\Admin\AppData\Local\Temp\6031.tmp"86⤵PID:3364
-
C:\Users\Admin\AppData\Local\Temp\608F.tmp"C:\Users\Admin\AppData\Local\Temp\608F.tmp"87⤵PID:3648
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"88⤵PID:2252
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"89⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"90⤵PID:4304
-
C:\Users\Admin\AppData\Local\Temp\61F6.tmp"C:\Users\Admin\AppData\Local\Temp\61F6.tmp"91⤵PID:1976
-
C:\Users\Admin\AppData\Local\Temp\6244.tmp"C:\Users\Admin\AppData\Local\Temp\6244.tmp"92⤵PID:2404
-
C:\Users\Admin\AppData\Local\Temp\6292.tmp"C:\Users\Admin\AppData\Local\Temp\6292.tmp"93⤵PID:3468
-
C:\Users\Admin\AppData\Local\Temp\62E0.tmp"C:\Users\Admin\AppData\Local\Temp\62E0.tmp"94⤵PID:264
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"95⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\637D.tmp"C:\Users\Admin\AppData\Local\Temp\637D.tmp"96⤵PID:4080
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"97⤵PID:1736
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"98⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"99⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"100⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"101⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"102⤵PID:3804
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"103⤵PID:3240
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"104⤵PID:3588
-
C:\Users\Admin\AppData\Local\Temp\668A.tmp"C:\Users\Admin\AppData\Local\Temp\668A.tmp"105⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\66D8.tmp"C:\Users\Admin\AppData\Local\Temp\66D8.tmp"106⤵PID:4524
-
C:\Users\Admin\AppData\Local\Temp\6726.tmp"C:\Users\Admin\AppData\Local\Temp\6726.tmp"107⤵PID:2344
-
C:\Users\Admin\AppData\Local\Temp\6774.tmp"C:\Users\Admin\AppData\Local\Temp\6774.tmp"108⤵PID:1344
-
C:\Users\Admin\AppData\Local\Temp\67D2.tmp"C:\Users\Admin\AppData\Local\Temp\67D2.tmp"109⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\6830.tmp"C:\Users\Admin\AppData\Local\Temp\6830.tmp"110⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\687E.tmp"C:\Users\Admin\AppData\Local\Temp\687E.tmp"111⤵PID:3088
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"112⤵PID:3888
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"113⤵PID:3908
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"114⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"115⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"116⤵PID:5104
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"117⤵PID:3100
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"118⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"119⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"C:\Users\Admin\AppData\Local\Temp\6B4D.tmp"120⤵PID:412
-
C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"C:\Users\Admin\AppData\Local\Temp\6B9B.tmp"121⤵PID:2692
-
C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"C:\Users\Admin\AppData\Local\Temp\6BE9.tmp"122⤵PID:2720
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-