Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
98s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 12:40
Static task
static1
Behavioral task
behavioral1
Sample
d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
General
-
Target
d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe
-
Size
529KB
-
MD5
d26f692a3f5995f19ea32344daddc8f0
-
SHA1
1b758ac13b8b945f6801030f028a36745ce72d57
-
SHA256
b2254f97960503a22d1cb01dd99973468de0382f470475e5eb85260a6f22d340
-
SHA512
1fd7b0ce3cd494aefe054cfe67bd53507e47fdd8f9ae2d2d1e042262afe7c2303fcf35bfdc6c27a9bb5d6a781328cfd49e0256b6fa8f07cd7b6a528834c6da8c
-
SSDEEP
12288:NU5rCOTeijO98fR0x9q+j3jMmrHAh5uiwoSX0nTZwlH4Hp:NUQOJjsX9q+j3ZHESX0nTSlH4Hp
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 4484 42C6.tmp 4100 4343.tmp 2880 43B0.tmp 4444 442D.tmp 4516 44AA.tmp 4592 4537.tmp 1680 4585.tmp 4616 45E2.tmp 4892 4650.tmp 2452 46CD.tmp 1232 473A.tmp 3156 47C7.tmp 3148 4825.tmp 852 4882.tmp 4560 48E0.tmp 3708 495D.tmp 4824 49CA.tmp 2192 4A28.tmp 548 4AB5.tmp 112 4B32.tmp 4644 4B90.tmp 1368 4BFD.tmp 3868 4C4B.tmp 4900 4CB8.tmp 1616 4D26.tmp 4248 4DA3.tmp 4368 4E01.tmp 4332 4E5E.tmp 612 4ECC.tmp 3080 4F49.tmp 3776 4FA6.tmp 4136 5004.tmp 3524 5052.tmp 1860 50A0.tmp 3968 50EF.tmp 3508 513D.tmp 2200 518B.tmp 4388 51D9.tmp 2212 5227.tmp 3496 5275.tmp 4424 52C3.tmp 2072 5311.tmp 1192 5360.tmp 3416 53AE.tmp 4856 53FC.tmp 4460 544A.tmp 4444 5498.tmp 3132 54E6.tmp 1180 5534.tmp 1036 5582.tmp 3704 55E0.tmp 3448 562E.tmp 804 567C.tmp 1064 56CB.tmp 1756 5719.tmp 2532 5776.tmp 2776 57D4.tmp 448 5822.tmp 4752 5870.tmp 1900 58AF.tmp 5096 58FD.tmp 1384 594B.tmp 4004 59A9.tmp 2220 59F7.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 416 wrote to memory of 4484 416 d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe 81 PID 416 wrote to memory of 4484 416 d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe 81 PID 416 wrote to memory of 4484 416 d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe 81 PID 4484 wrote to memory of 4100 4484 42C6.tmp 83 PID 4484 wrote to memory of 4100 4484 42C6.tmp 83 PID 4484 wrote to memory of 4100 4484 42C6.tmp 83 PID 4100 wrote to memory of 2880 4100 4343.tmp 84 PID 4100 wrote to memory of 2880 4100 4343.tmp 84 PID 4100 wrote to memory of 2880 4100 4343.tmp 84 PID 2880 wrote to memory of 4444 2880 43B0.tmp 85 PID 2880 wrote to memory of 4444 2880 43B0.tmp 85 PID 2880 wrote to memory of 4444 2880 43B0.tmp 85 PID 4444 wrote to memory of 4516 4444 442D.tmp 87 PID 4444 wrote to memory of 4516 4444 442D.tmp 87 PID 4444 wrote to memory of 4516 4444 442D.tmp 87 PID 4516 wrote to memory of 4592 4516 44AA.tmp 89 PID 4516 wrote to memory of 4592 4516 44AA.tmp 89 PID 4516 wrote to memory of 4592 4516 44AA.tmp 89 PID 4592 wrote to memory of 1680 4592 4537.tmp 90 PID 4592 wrote to memory of 1680 4592 4537.tmp 90 PID 4592 wrote to memory of 1680 4592 4537.tmp 90 PID 1680 wrote to memory of 4616 1680 4585.tmp 91 PID 1680 wrote to memory of 4616 1680 4585.tmp 91 PID 1680 wrote to memory of 4616 1680 4585.tmp 91 PID 4616 wrote to memory of 4892 4616 45E2.tmp 93 PID 4616 wrote to memory of 4892 4616 45E2.tmp 93 PID 4616 wrote to memory of 4892 4616 45E2.tmp 93 PID 4892 wrote to memory of 2452 4892 4650.tmp 94 PID 4892 wrote to memory of 2452 4892 4650.tmp 94 PID 4892 wrote to memory of 2452 4892 4650.tmp 94 PID 2452 wrote to memory of 1232 2452 46CD.tmp 95 PID 2452 wrote to memory of 1232 2452 46CD.tmp 95 PID 2452 wrote to memory of 1232 2452 46CD.tmp 95 PID 1232 wrote to memory of 3156 1232 473A.tmp 96 PID 1232 wrote to memory of 3156 1232 473A.tmp 96 PID 1232 wrote to memory of 3156 1232 473A.tmp 96 PID 3156 wrote to memory of 3148 3156 47C7.tmp 97 PID 3156 wrote to memory of 3148 3156 47C7.tmp 97 PID 3156 wrote to memory of 3148 3156 47C7.tmp 97 PID 3148 wrote to memory of 852 3148 4825.tmp 98 PID 3148 wrote to memory of 852 3148 4825.tmp 98 PID 3148 wrote to memory of 852 3148 4825.tmp 98 PID 852 wrote to memory of 4560 852 4882.tmp 99 PID 852 wrote to memory of 4560 852 4882.tmp 99 PID 852 wrote to memory of 4560 852 4882.tmp 99 PID 4560 wrote to memory of 3708 4560 48E0.tmp 100 PID 4560 wrote to memory of 3708 4560 48E0.tmp 100 PID 4560 wrote to memory of 3708 4560 48E0.tmp 100 PID 3708 wrote to memory of 4824 3708 495D.tmp 101 PID 3708 wrote to memory of 4824 3708 495D.tmp 101 PID 3708 wrote to memory of 4824 3708 495D.tmp 101 PID 4824 wrote to memory of 2192 4824 49CA.tmp 102 PID 4824 wrote to memory of 2192 4824 49CA.tmp 102 PID 4824 wrote to memory of 2192 4824 49CA.tmp 102 PID 2192 wrote to memory of 548 2192 4A28.tmp 103 PID 2192 wrote to memory of 548 2192 4A28.tmp 103 PID 2192 wrote to memory of 548 2192 4A28.tmp 103 PID 548 wrote to memory of 112 548 4AB5.tmp 104 PID 548 wrote to memory of 112 548 4AB5.tmp 104 PID 548 wrote to memory of 112 548 4AB5.tmp 104 PID 112 wrote to memory of 4644 112 4B32.tmp 105 PID 112 wrote to memory of 4644 112 4B32.tmp 105 PID 112 wrote to memory of 4644 112 4B32.tmp 105 PID 4644 wrote to memory of 1368 4644 4B90.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\d26f692a3f5995f19ea32344daddc8f0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\42C6.tmp"C:\Users\Admin\AppData\Local\Temp\42C6.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\Users\Admin\AppData\Local\Temp\4343.tmp"C:\Users\Admin\AppData\Local\Temp\4343.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Users\Admin\AppData\Local\Temp\43B0.tmp"C:\Users\Admin\AppData\Local\Temp\43B0.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
C:\Users\Admin\AppData\Local\Temp\442D.tmp"C:\Users\Admin\AppData\Local\Temp\442D.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4592 -
C:\Users\Admin\AppData\Local\Temp\4585.tmp"C:\Users\Admin\AppData\Local\Temp\4585.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\45E2.tmp"C:\Users\Admin\AppData\Local\Temp\45E2.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Users\Admin\AppData\Local\Temp\4650.tmp"C:\Users\Admin\AppData\Local\Temp\4650.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2452 -
C:\Users\Admin\AppData\Local\Temp\473A.tmp"C:\Users\Admin\AppData\Local\Temp\473A.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1232 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3156 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Users\Admin\AppData\Local\Temp\495D.tmp"C:\Users\Admin\AppData\Local\Temp\495D.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\49CA.tmp"C:\Users\Admin\AppData\Local\Temp\49CA.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4824 -
C:\Users\Admin\AppData\Local\Temp\4A28.tmp"C:\Users\Admin\AppData\Local\Temp\4A28.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Users\Admin\AppData\Local\Temp\4B32.tmp"C:\Users\Admin\AppData\Local\Temp\4B32.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Users\Admin\AppData\Local\Temp\4B90.tmp"C:\Users\Admin\AppData\Local\Temp\4B90.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"23⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"24⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"C:\Users\Admin\AppData\Local\Temp\4CB8.tmp"25⤵
- Executes dropped EXE
PID:4900 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"26⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"27⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"28⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"29⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"C:\Users\Admin\AppData\Local\Temp\4ECC.tmp"30⤵
- Executes dropped EXE
PID:612 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"31⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"32⤵
- Executes dropped EXE
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"33⤵
- Executes dropped EXE
PID:4136 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"34⤵
- Executes dropped EXE
PID:3524 -
C:\Users\Admin\AppData\Local\Temp\50A0.tmp"C:\Users\Admin\AppData\Local\Temp\50A0.tmp"35⤵
- Executes dropped EXE
PID:1860 -
C:\Users\Admin\AppData\Local\Temp\50EF.tmp"C:\Users\Admin\AppData\Local\Temp\50EF.tmp"36⤵
- Executes dropped EXE
PID:3968 -
C:\Users\Admin\AppData\Local\Temp\513D.tmp"C:\Users\Admin\AppData\Local\Temp\513D.tmp"37⤵
- Executes dropped EXE
PID:3508 -
C:\Users\Admin\AppData\Local\Temp\518B.tmp"C:\Users\Admin\AppData\Local\Temp\518B.tmp"38⤵
- Executes dropped EXE
PID:2200 -
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"39⤵
- Executes dropped EXE
PID:4388 -
C:\Users\Admin\AppData\Local\Temp\5227.tmp"C:\Users\Admin\AppData\Local\Temp\5227.tmp"40⤵
- Executes dropped EXE
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\5275.tmp"C:\Users\Admin\AppData\Local\Temp\5275.tmp"41⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"42⤵
- Executes dropped EXE
PID:4424 -
C:\Users\Admin\AppData\Local\Temp\5311.tmp"C:\Users\Admin\AppData\Local\Temp\5311.tmp"43⤵
- Executes dropped EXE
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"44⤵
- Executes dropped EXE
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\53AE.tmp"C:\Users\Admin\AppData\Local\Temp\53AE.tmp"45⤵
- Executes dropped EXE
PID:3416 -
C:\Users\Admin\AppData\Local\Temp\53FC.tmp"C:\Users\Admin\AppData\Local\Temp\53FC.tmp"46⤵
- Executes dropped EXE
PID:4856 -
C:\Users\Admin\AppData\Local\Temp\544A.tmp"C:\Users\Admin\AppData\Local\Temp\544A.tmp"47⤵
- Executes dropped EXE
PID:4460 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"48⤵
- Executes dropped EXE
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"49⤵
- Executes dropped EXE
PID:3132 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"50⤵
- Executes dropped EXE
PID:1180 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"51⤵
- Executes dropped EXE
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\55E0.tmp"C:\Users\Admin\AppData\Local\Temp\55E0.tmp"52⤵
- Executes dropped EXE
PID:3704 -
C:\Users\Admin\AppData\Local\Temp\562E.tmp"C:\Users\Admin\AppData\Local\Temp\562E.tmp"53⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\567C.tmp"C:\Users\Admin\AppData\Local\Temp\567C.tmp"54⤵
- Executes dropped EXE
PID:804 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"55⤵
- Executes dropped EXE
PID:1064 -
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"56⤵
- Executes dropped EXE
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"57⤵
- Executes dropped EXE
PID:2532 -
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"58⤵
- Executes dropped EXE
PID:2776 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"59⤵
- Executes dropped EXE
PID:448 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"60⤵
- Executes dropped EXE
PID:4752 -
C:\Users\Admin\AppData\Local\Temp\58AF.tmp"C:\Users\Admin\AppData\Local\Temp\58AF.tmp"61⤵
- Executes dropped EXE
PID:1900 -
C:\Users\Admin\AppData\Local\Temp\58FD.tmp"C:\Users\Admin\AppData\Local\Temp\58FD.tmp"62⤵
- Executes dropped EXE
PID:5096 -
C:\Users\Admin\AppData\Local\Temp\594B.tmp"C:\Users\Admin\AppData\Local\Temp\594B.tmp"63⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\59A9.tmp"C:\Users\Admin\AppData\Local\Temp\59A9.tmp"64⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\59F7.tmp"C:\Users\Admin\AppData\Local\Temp\59F7.tmp"65⤵
- Executes dropped EXE
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\5A55.tmp"C:\Users\Admin\AppData\Local\Temp\5A55.tmp"66⤵PID:1472
-
C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"C:\Users\Admin\AppData\Local\Temp\5AA3.tmp"67⤵PID:2232
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"68⤵PID:2064
-
C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"C:\Users\Admin\AppData\Local\Temp\5B3F.tmp"69⤵PID:4960
-
C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"C:\Users\Admin\AppData\Local\Temp\5B8D.tmp"70⤵PID:5008
-
C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"C:\Users\Admin\AppData\Local\Temp\5BEB.tmp"71⤵PID:1200
-
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"72⤵PID:1152
-
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"73⤵PID:856
-
C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"C:\Users\Admin\AppData\Local\Temp\5CD5.tmp"74⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5D24.tmp"C:\Users\Admin\AppData\Local\Temp\5D24.tmp"75⤵PID:1556
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"76⤵PID:632
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"77⤵PID:2700
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"78⤵PID:1044
-
C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"C:\Users\Admin\AppData\Local\Temp\5E6C.tmp"79⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"80⤵PID:4196
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"81⤵PID:696
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"82⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"C:\Users\Admin\AppData\Local\Temp\5FD3.tmp"83⤵PID:476
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"84⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"85⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\60CD.tmp"C:\Users\Admin\AppData\Local\Temp\60CD.tmp"86⤵PID:3220
-
C:\Users\Admin\AppData\Local\Temp\611B.tmp"C:\Users\Admin\AppData\Local\Temp\611B.tmp"87⤵PID:2872
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"88⤵PID:1768
-
C:\Users\Admin\AppData\Local\Temp\61D7.tmp"C:\Users\Admin\AppData\Local\Temp\61D7.tmp"89⤵PID:656
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"90⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\6283.tmp"C:\Users\Admin\AppData\Local\Temp\6283.tmp"91⤵PID:4984
-
C:\Users\Admin\AppData\Local\Temp\62D1.tmp"C:\Users\Admin\AppData\Local\Temp\62D1.tmp"92⤵PID:1780
-
C:\Users\Admin\AppData\Local\Temp\632E.tmp"C:\Users\Admin\AppData\Local\Temp\632E.tmp"93⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"94⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"95⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\6409.tmp"C:\Users\Admin\AppData\Local\Temp\6409.tmp"96⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\6457.tmp"C:\Users\Admin\AppData\Local\Temp\6457.tmp"97⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\64B5.tmp"C:\Users\Admin\AppData\Local\Temp\64B5.tmp"98⤵PID:4904
-
C:\Users\Admin\AppData\Local\Temp\6503.tmp"C:\Users\Admin\AppData\Local\Temp\6503.tmp"99⤵PID:5100
-
C:\Users\Admin\AppData\Local\Temp\6561.tmp"C:\Users\Admin\AppData\Local\Temp\6561.tmp"100⤵PID:3956
-
C:\Users\Admin\AppData\Local\Temp\65AF.tmp"C:\Users\Admin\AppData\Local\Temp\65AF.tmp"101⤵PID:4804
-
C:\Users\Admin\AppData\Local\Temp\65FD.tmp"C:\Users\Admin\AppData\Local\Temp\65FD.tmp"102⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\665B.tmp"C:\Users\Admin\AppData\Local\Temp\665B.tmp"103⤵PID:4292
-
C:\Users\Admin\AppData\Local\Temp\66B9.tmp"C:\Users\Admin\AppData\Local\Temp\66B9.tmp"104⤵PID:1940
-
C:\Users\Admin\AppData\Local\Temp\6707.tmp"C:\Users\Admin\AppData\Local\Temp\6707.tmp"105⤵PID:3976
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"106⤵PID:1192
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"107⤵PID:3416
-
C:\Users\Admin\AppData\Local\Temp\6801.tmp"C:\Users\Admin\AppData\Local\Temp\6801.tmp"108⤵PID:4856
-
C:\Users\Admin\AppData\Local\Temp\684F.tmp"C:\Users\Admin\AppData\Local\Temp\684F.tmp"109⤵PID:3988
-
C:\Users\Admin\AppData\Local\Temp\689D.tmp"C:\Users\Admin\AppData\Local\Temp\689D.tmp"110⤵PID:1280
-
C:\Users\Admin\AppData\Local\Temp\68FB.tmp"C:\Users\Admin\AppData\Local\Temp\68FB.tmp"111⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\6959.tmp"C:\Users\Admin\AppData\Local\Temp\6959.tmp"112⤵PID:4352
-
C:\Users\Admin\AppData\Local\Temp\69A7.tmp"C:\Users\Admin\AppData\Local\Temp\69A7.tmp"113⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\6A04.tmp"C:\Users\Admin\AppData\Local\Temp\6A04.tmp"114⤵PID:2892
-
C:\Users\Admin\AppData\Local\Temp\6A62.tmp"C:\Users\Admin\AppData\Local\Temp\6A62.tmp"115⤵PID:3520
-
C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"C:\Users\Admin\AppData\Local\Temp\6AB0.tmp"116⤵PID:1372
-
C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"C:\Users\Admin\AppData\Local\Temp\6AFE.tmp"117⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"C:\Users\Admin\AppData\Local\Temp\6B5C.tmp"118⤵PID:3456
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"119⤵PID:4592
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"120⤵PID:2964
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"121⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"122⤵PID:1084
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-