Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 09:00
Static task
static1
Behavioral task
behavioral1
Sample
b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe
Resource
win10v2004-20240426-en
General
-
Target
b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe
-
Size
530KB
-
MD5
b525017b0ecdeda7b472181d0ed805e0
-
SHA1
e600d07a0fab8e3aa2d9716cf9adab384f04d92f
-
SHA256
1a809b3ab424e4afee9dcf5c263925656d0ca8af6a79e7c09b0b7618bc00e067
-
SHA512
44d5890dc2fc168de910e5b723e3f204d1620c956a80bcb04439b629e9fc3f765910a52b8acfe4bf01331a7a1604df36237549defffbb48569937b488a482de2
-
SSDEEP
12288:AU5rCOTeioDwqE003AtuFTi5MOxwZDlg/nNZulFVg0M1:AUQOJojl3MOx8DK/NclFV/M1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 3148 2DF5.tmp 1448 2E44.tmp 440 2E92.tmp 4904 2EEF.tmp 1768 2F3E.tmp 2620 2F9B.tmp 2832 2FF9.tmp 3640 3047.tmp 1400 30B5.tmp 5068 3122.tmp 1292 318F.tmp 2688 31DD.tmp 2152 322C.tmp 3304 3289.tmp 3204 32F7.tmp 2556 3354.tmp 1016 33B2.tmp 452 3420.tmp 1924 347D.tmp 3844 34CB.tmp 2644 3539.tmp 4296 35A6.tmp 3872 3604.tmp 1176 3671.tmp 632 36CF.tmp 1728 371D.tmp 2392 378B.tmp 4560 37F8.tmp 2220 3856.tmp 3796 38C3.tmp 4760 3940.tmp 2388 398E.tmp 1228 39CD.tmp 2532 3A1B.tmp 3708 3A69.tmp 4312 3AB7.tmp 4604 3B05.tmp 4456 3B53.tmp 2360 3BA1.tmp 1888 3BF0.tmp 2072 3C3E.tmp 680 3CAB.tmp 3056 3CF9.tmp 2740 3D57.tmp 1468 3DB5.tmp 3196 3E03.tmp 2972 3E51.tmp 2368 3E9F.tmp 3984 3EED.tmp 1252 3F3B.tmp 4932 3F89.tmp 2344 3FD8.tmp 4532 4035.tmp 3304 4093.tmp 1368 40E1.tmp 3988 412F.tmp 4008 417D.tmp 2736 41DB.tmp 4768 4239.tmp 1224 4297.tmp 4296 42F4.tmp 1524 4352.tmp 1580 43A0.tmp 4276 43EE.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4988 wrote to memory of 3148 4988 b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe 83 PID 4988 wrote to memory of 3148 4988 b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe 83 PID 4988 wrote to memory of 3148 4988 b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe 83 PID 3148 wrote to memory of 1448 3148 2DF5.tmp 84 PID 3148 wrote to memory of 1448 3148 2DF5.tmp 84 PID 3148 wrote to memory of 1448 3148 2DF5.tmp 84 PID 1448 wrote to memory of 440 1448 2E44.tmp 85 PID 1448 wrote to memory of 440 1448 2E44.tmp 85 PID 1448 wrote to memory of 440 1448 2E44.tmp 85 PID 440 wrote to memory of 4904 440 2E92.tmp 87 PID 440 wrote to memory of 4904 440 2E92.tmp 87 PID 440 wrote to memory of 4904 440 2E92.tmp 87 PID 4904 wrote to memory of 1768 4904 2EEF.tmp 89 PID 4904 wrote to memory of 1768 4904 2EEF.tmp 89 PID 4904 wrote to memory of 1768 4904 2EEF.tmp 89 PID 1768 wrote to memory of 2620 1768 2F3E.tmp 91 PID 1768 wrote to memory of 2620 1768 2F3E.tmp 91 PID 1768 wrote to memory of 2620 1768 2F3E.tmp 91 PID 2620 wrote to memory of 2832 2620 2F9B.tmp 92 PID 2620 wrote to memory of 2832 2620 2F9B.tmp 92 PID 2620 wrote to memory of 2832 2620 2F9B.tmp 92 PID 2832 wrote to memory of 3640 2832 2FF9.tmp 93 PID 2832 wrote to memory of 3640 2832 2FF9.tmp 93 PID 2832 wrote to memory of 3640 2832 2FF9.tmp 93 PID 3640 wrote to memory of 1400 3640 3047.tmp 94 PID 3640 wrote to memory of 1400 3640 3047.tmp 94 PID 3640 wrote to memory of 1400 3640 3047.tmp 94 PID 1400 wrote to memory of 5068 1400 30B5.tmp 95 PID 1400 wrote to memory of 5068 1400 30B5.tmp 95 PID 1400 wrote to memory of 5068 1400 30B5.tmp 95 PID 5068 wrote to memory of 1292 5068 3122.tmp 96 PID 5068 wrote to memory of 1292 5068 3122.tmp 96 PID 5068 wrote to memory of 1292 5068 3122.tmp 96 PID 1292 wrote to memory of 2688 1292 318F.tmp 97 PID 1292 wrote to memory of 2688 1292 318F.tmp 97 PID 1292 wrote to memory of 2688 1292 318F.tmp 97 PID 2688 wrote to memory of 2152 2688 31DD.tmp 98 PID 2688 wrote to memory of 2152 2688 31DD.tmp 98 PID 2688 wrote to memory of 2152 2688 31DD.tmp 98 PID 2152 wrote to memory of 3304 2152 322C.tmp 99 PID 2152 wrote to memory of 3304 2152 322C.tmp 99 PID 2152 wrote to memory of 3304 2152 322C.tmp 99 PID 3304 wrote to memory of 3204 3304 3289.tmp 100 PID 3304 wrote to memory of 3204 3304 3289.tmp 100 PID 3304 wrote to memory of 3204 3304 3289.tmp 100 PID 3204 wrote to memory of 2556 3204 32F7.tmp 101 PID 3204 wrote to memory of 2556 3204 32F7.tmp 101 PID 3204 wrote to memory of 2556 3204 32F7.tmp 101 PID 2556 wrote to memory of 1016 2556 3354.tmp 102 PID 2556 wrote to memory of 1016 2556 3354.tmp 102 PID 2556 wrote to memory of 1016 2556 3354.tmp 102 PID 1016 wrote to memory of 452 1016 33B2.tmp 103 PID 1016 wrote to memory of 452 1016 33B2.tmp 103 PID 1016 wrote to memory of 452 1016 33B2.tmp 103 PID 452 wrote to memory of 1924 452 3420.tmp 104 PID 452 wrote to memory of 1924 452 3420.tmp 104 PID 452 wrote to memory of 1924 452 3420.tmp 104 PID 1924 wrote to memory of 3844 1924 347D.tmp 105 PID 1924 wrote to memory of 3844 1924 347D.tmp 105 PID 1924 wrote to memory of 3844 1924 347D.tmp 105 PID 3844 wrote to memory of 2644 3844 34CB.tmp 106 PID 3844 wrote to memory of 2644 3844 34CB.tmp 106 PID 3844 wrote to memory of 2644 3844 34CB.tmp 106 PID 2644 wrote to memory of 4296 2644 3539.tmp 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\b525017b0ecdeda7b472181d0ed805e0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"C:\Users\Admin\AppData\Local\Temp\2DF5.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\2E44.tmp"C:\Users\Admin\AppData\Local\Temp\2E44.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Users\Admin\AppData\Local\Temp\2E92.tmp"C:\Users\Admin\AppData\Local\Temp\2E92.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"C:\Users\Admin\AppData\Local\Temp\2EEF.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"C:\Users\Admin\AppData\Local\Temp\2F3E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"C:\Users\Admin\AppData\Local\Temp\2F9B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"C:\Users\Admin\AppData\Local\Temp\2FF9.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\3047.tmp"C:\Users\Admin\AppData\Local\Temp\3047.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\30B5.tmp"C:\Users\Admin\AppData\Local\Temp\30B5.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\3122.tmp"C:\Users\Admin\AppData\Local\Temp\3122.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5068 -
C:\Users\Admin\AppData\Local\Temp\318F.tmp"C:\Users\Admin\AppData\Local\Temp\318F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Users\Admin\AppData\Local\Temp\31DD.tmp"C:\Users\Admin\AppData\Local\Temp\31DD.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\322C.tmp"C:\Users\Admin\AppData\Local\Temp\322C.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\3289.tmp"C:\Users\Admin\AppData\Local\Temp\3289.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\32F7.tmp"C:\Users\Admin\AppData\Local\Temp\32F7.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\33B2.tmp"C:\Users\Admin\AppData\Local\Temp\33B2.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Temp\3420.tmp"C:\Users\Admin\AppData\Local\Temp\3420.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\347D.tmp"C:\Users\Admin\AppData\Local\Temp\347D.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Users\Admin\AppData\Local\Temp\34CB.tmp"C:\Users\Admin\AppData\Local\Temp\34CB.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\35A6.tmp"C:\Users\Admin\AppData\Local\Temp\35A6.tmp"23⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\3604.tmp"C:\Users\Admin\AppData\Local\Temp\3604.tmp"24⤵
- Executes dropped EXE
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\3671.tmp"C:\Users\Admin\AppData\Local\Temp\3671.tmp"25⤵
- Executes dropped EXE
PID:1176 -
C:\Users\Admin\AppData\Local\Temp\36CF.tmp"C:\Users\Admin\AppData\Local\Temp\36CF.tmp"26⤵
- Executes dropped EXE
PID:632 -
C:\Users\Admin\AppData\Local\Temp\371D.tmp"C:\Users\Admin\AppData\Local\Temp\371D.tmp"27⤵
- Executes dropped EXE
PID:1728 -
C:\Users\Admin\AppData\Local\Temp\378B.tmp"C:\Users\Admin\AppData\Local\Temp\378B.tmp"28⤵
- Executes dropped EXE
PID:2392 -
C:\Users\Admin\AppData\Local\Temp\37F8.tmp"C:\Users\Admin\AppData\Local\Temp\37F8.tmp"29⤵
- Executes dropped EXE
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\3856.tmp"C:\Users\Admin\AppData\Local\Temp\3856.tmp"30⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\38C3.tmp"C:\Users\Admin\AppData\Local\Temp\38C3.tmp"31⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3940.tmp"C:\Users\Admin\AppData\Local\Temp\3940.tmp"32⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\398E.tmp"C:\Users\Admin\AppData\Local\Temp\398E.tmp"33⤵
- Executes dropped EXE
PID:2388 -
C:\Users\Admin\AppData\Local\Temp\39CD.tmp"C:\Users\Admin\AppData\Local\Temp\39CD.tmp"34⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"C:\Users\Admin\AppData\Local\Temp\3A1B.tmp"35⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\3A69.tmp"C:\Users\Admin\AppData\Local\Temp\3A69.tmp"36⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"C:\Users\Admin\AppData\Local\Temp\3AB7.tmp"37⤵
- Executes dropped EXE
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\3B05.tmp"C:\Users\Admin\AppData\Local\Temp\3B05.tmp"38⤵
- Executes dropped EXE
PID:4604 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"39⤵
- Executes dropped EXE
PID:4456 -
C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"C:\Users\Admin\AppData\Local\Temp\3BA1.tmp"40⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"C:\Users\Admin\AppData\Local\Temp\3BF0.tmp"41⤵
- Executes dropped EXE
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"42⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"C:\Users\Admin\AppData\Local\Temp\3CAB.tmp"43⤵
- Executes dropped EXE
PID:680 -
C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"C:\Users\Admin\AppData\Local\Temp\3CF9.tmp"44⤵
- Executes dropped EXE
PID:3056 -
C:\Users\Admin\AppData\Local\Temp\3D57.tmp"C:\Users\Admin\AppData\Local\Temp\3D57.tmp"45⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"C:\Users\Admin\AppData\Local\Temp\3DB5.tmp"46⤵
- Executes dropped EXE
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\3E03.tmp"C:\Users\Admin\AppData\Local\Temp\3E03.tmp"47⤵
- Executes dropped EXE
PID:3196 -
C:\Users\Admin\AppData\Local\Temp\3E51.tmp"C:\Users\Admin\AppData\Local\Temp\3E51.tmp"48⤵
- Executes dropped EXE
PID:2972 -
C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"C:\Users\Admin\AppData\Local\Temp\3E9F.tmp"49⤵
- Executes dropped EXE
PID:2368 -
C:\Users\Admin\AppData\Local\Temp\3EED.tmp"C:\Users\Admin\AppData\Local\Temp\3EED.tmp"50⤵
- Executes dropped EXE
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"51⤵
- Executes dropped EXE
PID:1252 -
C:\Users\Admin\AppData\Local\Temp\3F89.tmp"C:\Users\Admin\AppData\Local\Temp\3F89.tmp"52⤵
- Executes dropped EXE
PID:4932 -
C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"C:\Users\Admin\AppData\Local\Temp\3FD8.tmp"53⤵
- Executes dropped EXE
PID:2344 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"54⤵
- Executes dropped EXE
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\4093.tmp"C:\Users\Admin\AppData\Local\Temp\4093.tmp"55⤵
- Executes dropped EXE
PID:3304 -
C:\Users\Admin\AppData\Local\Temp\40E1.tmp"C:\Users\Admin\AppData\Local\Temp\40E1.tmp"56⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"57⤵
- Executes dropped EXE
PID:3988 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"58⤵
- Executes dropped EXE
PID:4008 -
C:\Users\Admin\AppData\Local\Temp\41DB.tmp"C:\Users\Admin\AppData\Local\Temp\41DB.tmp"59⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\4239.tmp"C:\Users\Admin\AppData\Local\Temp\4239.tmp"60⤵
- Executes dropped EXE
PID:4768 -
C:\Users\Admin\AppData\Local\Temp\4297.tmp"C:\Users\Admin\AppData\Local\Temp\4297.tmp"61⤵
- Executes dropped EXE
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\42F4.tmp"C:\Users\Admin\AppData\Local\Temp\42F4.tmp"62⤵
- Executes dropped EXE
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\4352.tmp"C:\Users\Admin\AppData\Local\Temp\4352.tmp"63⤵
- Executes dropped EXE
PID:1524 -
C:\Users\Admin\AppData\Local\Temp\43A0.tmp"C:\Users\Admin\AppData\Local\Temp\43A0.tmp"64⤵
- Executes dropped EXE
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"65⤵
- Executes dropped EXE
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\444C.tmp"C:\Users\Admin\AppData\Local\Temp\444C.tmp"66⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"67⤵PID:1728
-
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"68⤵PID:2216
-
C:\Users\Admin\AppData\Local\Temp\4546.tmp"C:\Users\Admin\AppData\Local\Temp\4546.tmp"69⤵PID:1544
-
C:\Users\Admin\AppData\Local\Temp\45A4.tmp"C:\Users\Admin\AppData\Local\Temp\45A4.tmp"70⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\4602.tmp"C:\Users\Admin\AppData\Local\Temp\4602.tmp"71⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\465F.tmp"C:\Users\Admin\AppData\Local\Temp\465F.tmp"72⤵PID:4256
-
C:\Users\Admin\AppData\Local\Temp\46AE.tmp"C:\Users\Admin\AppData\Local\Temp\46AE.tmp"73⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\46FC.tmp"C:\Users\Admin\AppData\Local\Temp\46FC.tmp"74⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\4759.tmp"C:\Users\Admin\AppData\Local\Temp\4759.tmp"75⤵PID:4668
-
C:\Users\Admin\AppData\Local\Temp\47B7.tmp"C:\Users\Admin\AppData\Local\Temp\47B7.tmp"76⤵PID:1520
-
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"77⤵PID:4796
-
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"78⤵PID:3176
-
C:\Users\Admin\AppData\Local\Temp\48B1.tmp"C:\Users\Admin\AppData\Local\Temp\48B1.tmp"79⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\490F.tmp"C:\Users\Admin\AppData\Local\Temp\490F.tmp"80⤵PID:3808
-
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"81⤵PID:4140
-
C:\Users\Admin\AppData\Local\Temp\49BB.tmp"C:\Users\Admin\AppData\Local\Temp\49BB.tmp"82⤵PID:3420
-
C:\Users\Admin\AppData\Local\Temp\4A19.tmp"C:\Users\Admin\AppData\Local\Temp\4A19.tmp"83⤵PID:428
-
C:\Users\Admin\AppData\Local\Temp\4A67.tmp"C:\Users\Admin\AppData\Local\Temp\4A67.tmp"84⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"85⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"86⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\4B70.tmp"C:\Users\Admin\AppData\Local\Temp\4B70.tmp"87⤵PID:3544
-
C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"C:\Users\Admin\AppData\Local\Temp\4BCE.tmp"88⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"89⤵PID:4224
-
C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"C:\Users\Admin\AppData\Local\Temp\4C8A.tmp"90⤵PID:4624
-
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"91⤵PID:4708
-
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"92⤵PID:2120
-
C:\Users\Admin\AppData\Local\Temp\4D84.tmp"C:\Users\Admin\AppData\Local\Temp\4D84.tmp"93⤵PID:2832
-
C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"C:\Users\Admin\AppData\Local\Temp\4DE1.tmp"94⤵PID:1772
-
C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"C:\Users\Admin\AppData\Local\Temp\4E3F.tmp"95⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"C:\Users\Admin\AppData\Local\Temp\4E9D.tmp"96⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"97⤵PID:2836
-
C:\Users\Admin\AppData\Local\Temp\4F58.tmp"C:\Users\Admin\AppData\Local\Temp\4F58.tmp"98⤵PID:744
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"99⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"100⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"101⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\50B0.tmp"C:\Users\Admin\AppData\Local\Temp\50B0.tmp"102⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\510E.tmp"C:\Users\Admin\AppData\Local\Temp\510E.tmp"103⤵PID:4480
-
C:\Users\Admin\AppData\Local\Temp\516C.tmp"C:\Users\Admin\AppData\Local\Temp\516C.tmp"104⤵PID:684
-
C:\Users\Admin\AppData\Local\Temp\51C9.tmp"C:\Users\Admin\AppData\Local\Temp\51C9.tmp"105⤵PID:4240
-
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"106⤵PID:4348
-
C:\Users\Admin\AppData\Local\Temp\5285.tmp"C:\Users\Admin\AppData\Local\Temp\5285.tmp"107⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\52E3.tmp"C:\Users\Admin\AppData\Local\Temp\52E3.tmp"108⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\5340.tmp"C:\Users\Admin\AppData\Local\Temp\5340.tmp"109⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"110⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"111⤵PID:4916
-
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"112⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"113⤵PID:1364
-
C:\Users\Admin\AppData\Local\Temp\5505.tmp"C:\Users\Admin\AppData\Local\Temp\5505.tmp"114⤵PID:3376
-
C:\Users\Admin\AppData\Local\Temp\5563.tmp"C:\Users\Admin\AppData\Local\Temp\5563.tmp"115⤵PID:468
-
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"116⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\560F.tmp"C:\Users\Admin\AppData\Local\Temp\560F.tmp"117⤵PID:4644
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"118⤵PID:3944
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"119⤵PID:4836
-
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"120⤵PID:1204
-
C:\Users\Admin\AppData\Local\Temp\5757.tmp"C:\Users\Admin\AppData\Local\Temp\5757.tmp"121⤵PID:5080
-
C:\Users\Admin\AppData\Local\Temp\57A5.tmp"C:\Users\Admin\AppData\Local\Temp\57A5.tmp"122⤵PID:2584
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-