Analysis
- max time kernel
150s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
18/05/2024, 01:53
Behavioral task
behavioral1
Sample
7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe
Resource
win7-20240220-en
4 signatures
150 seconds
General
- Target 7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe
- Size 712KB
- Sample240518-cbe82aeh3s
- SHA256 8f314c7d9599a1e6d31a1914448d5849d83d2565b97540e5771a7e02bf73aa11
- MD5 7070304b57e3f31a5f12c370129af0a0
- SHA1 9a6a4cc8354ef0dd6f2c2ea7e1e2c653e82396e9
- SHA512 e8db0ff3f5d463976fe845c87c5e977c6deed580cf2b1f8cc1f59bb18f21bfe07d3d5a2db6c7a617fe454d770cb4cf607e0e1a1ec8afcb505c71967a25ea30fb
- SSDEEP 12288:FU5rCOTeiDDIrH200PGIY11NRaTTID1MNZdCvq5TJLCvY90D8/LVBlVk736Y79G5:FUQOJDDITX01Y1/RagSNnCvq5TJLCvYR
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Malware Dropper & Backdoor - Berbew 32 IoCs
Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.
resource yara_rule behavioral2/files/0x0008000000023409-2.dat family_berbew behavioral2/files/0x000700000002340d-6.dat family_berbew behavioral2/files/0x000700000002340e-8.dat family_berbew behavioral2/files/0x000700000002340f-14.dat family_berbew behavioral2/files/0x0007000000023410-18.dat family_berbew behavioral2/files/0x0007000000023411-22.dat family_berbew behavioral2/files/0x0007000000023412-26.dat family_berbew behavioral2/files/0x000800000002340a-30.dat family_berbew behavioral2/files/0x0007000000023414-35.dat family_berbew behavioral2/files/0x000700000001d9e8-38.dat family_berbew behavioral2/files/0x0007000000023415-43.dat family_berbew behavioral2/files/0x0007000000023416-46.dat family_berbew behavioral2/files/0x0007000000023417-50.dat family_berbew behavioral2/files/0x000700000002341a-54.dat family_berbew behavioral2/files/0x000700000002341b-58.dat family_berbew behavioral2/files/0x0003000000022ab9-62.dat family_berbew behavioral2/files/0x0002000000022abc-66.dat family_berbew behavioral2/files/0x000b00000002336d-70.dat family_berbew behavioral2/files/0x000700000002341c-74.dat family_berbew behavioral2/files/0x000c00000002336c-78.dat family_berbew behavioral2/files/0x000700000002341d-82.dat family_berbew behavioral2/files/0x000700000002341e-86.dat family_berbew behavioral2/files/0x000500000002296b-90.dat family_berbew behavioral2/files/0x0008000000022958-94.dat family_berbew behavioral2/files/0x000700000002341f-98.dat family_berbew behavioral2/files/0x0007000000023420-102.dat family_berbew behavioral2/files/0x0007000000023421-106.dat family_berbew behavioral2/files/0x0008000000023422-110.dat family_berbew behavioral2/files/0x0008000000023424-114.dat family_berbew behavioral2/files/0x0007000000023425-118.dat family_berbew behavioral2/files/0x0007000000023426-122.dat family_berbew behavioral2/files/0x0007000000023427-126.dat family_berbew - Executes dropped EXE 64 IoCs
pid Process 2576 3112.tmp 1688 31BE.tmp 2828 324B.tmp 3404 32E7.tmp 816 3354.tmp 740 33C2.tmp 848 344E.tmp 384 34BC.tmp 1364 3539.tmp 3244 35B6.tmp 2260 3642.tmp 3048 36A0.tmp 2512 36FE.tmp 2788 375C.tmp 3248 37C9.tmp 5108 3836.tmp 4848 38A4.tmp 4976 3911.tmp 1496 39AD.tmp 2180 3A0B.tmp 1028 3A79.tmp 1392 3AC7.tmp 3796 3B53.tmp 2016 3BD0.tmp 3040 3C3E.tmp 1836 3CDA.tmp 4244 3D38.tmp 4248 3D95.tmp 2948 3E22.tmp 432 3ECE.tmp 4188 3F3B.tmp 3212 3FB8.tmp 3612 4035.tmp 4684 4083.tmp 1452 40D2.tmp 3448 412F.tmp 884 417D.tmp 3804 41CC.tmp 3404 4229.tmp 4704 4277.tmp 4084 42D5.tmp 4540 4333.tmp 3916 4391.tmp 4004 43EE.tmp 2644 443D.tmp 4024 449A.tmp 2788 44F8.tmp 3248 4556.tmp 3900 45B4.tmp 3540 4611.tmp 452 466F.tmp 3504 46BD.tmp 1052 471B.tmp 1496 4779.tmp 2448 47C7.tmp 3120 4825.tmp 2372 4882.tmp 1328 48F0.tmp 4928 494D.tmp 1772 499C.tmp 2016 49F9.tmp 1932 4A57.tmp 2964 4AC4.tmp 4192 4B22.tmp - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 2576 3128 7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe 82 PID 3128 wrote to memory of 2576 3128 7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe 82 PID 3128 wrote to memory of 2576 3128 7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe 82 PID 2576 wrote to memory of 1688 2576 3112.tmp 83 PID 2576 wrote to memory of 1688 2576 3112.tmp 83 PID 2576 wrote to memory of 1688 2576 3112.tmp 83 PID 1688 wrote to memory of 2828 1688 31BE.tmp 84 PID 1688 wrote to memory of 2828 1688 31BE.tmp 84 PID 1688 wrote to memory of 2828 1688 31BE.tmp 84 PID 2828 wrote to memory of 3404 2828 324B.tmp 86 PID 2828 wrote to memory of 3404 2828 324B.tmp 86 PID 2828 wrote to memory of 3404 2828 324B.tmp 86 PID 3404 wrote to memory of 816 3404 32E7.tmp 88 PID 3404 wrote to memory of 816 3404 32E7.tmp 88 PID 3404 wrote to memory of 816 3404 32E7.tmp 88 PID 816 wrote to memory of 740 816 3354.tmp 89 PID 816 wrote to memory of 740 816 3354.tmp 89 PID 816 wrote to memory of 740 816 3354.tmp 89 PID 740 wrote to memory of 848 740 33C2.tmp 91 PID 740 wrote to memory of 848 740 33C2.tmp 91 PID 740 wrote to memory of 848 740 33C2.tmp 91 PID 848 wrote to memory of 384 848 344E.tmp 92 PID 848 wrote to memory of 384 848 344E.tmp 92 PID 848 wrote to memory of 384 848 344E.tmp 92 PID 384 wrote to memory of 1364 384 34BC.tmp 93 PID 384 wrote to memory of 1364 384 34BC.tmp 93 PID 384 wrote to memory of 1364 384 34BC.tmp 93 PID 1364 wrote to memory of 3244 1364 3539.tmp 94 PID 1364 wrote to memory of 3244 1364 3539.tmp 94 PID 1364 wrote to memory of 3244 1364 3539.tmp 94 PID 3244 wrote to memory of 2260 3244 35B6.tmp 95 PID 3244 wrote to memory of 2260 3244 35B6.tmp 95 PID 3244 wrote to memory of 2260 3244 35B6.tmp 95 PID 2260 wrote to memory of 3048 2260 3642.tmp 96 PID 2260 wrote to memory of 3048 2260 3642.tmp 96 PID 2260 wrote to memory of 3048 2260 3642.tmp 96 PID 3048 wrote to memory of 2512 3048 36A0.tmp 97 PID 3048 wrote to memory of 2512 3048 36A0.tmp 97 PID 3048 wrote to memory of 2512 3048 36A0.tmp 97 PID 2512 wrote to memory of 2788 2512 36FE.tmp 98 PID 2512 wrote to memory of 2788 2512 36FE.tmp 98 PID 2512 wrote to memory of 2788 2512 36FE.tmp 98 PID 2788 wrote to memory of 3248 2788 375C.tmp 99 PID 2788 wrote to memory of 3248 2788 375C.tmp 99 PID 2788 wrote to memory of 3248 2788 375C.tmp 99 PID 3248 wrote to memory of 5108 3248 37C9.tmp 100 PID 3248 wrote to memory of 5108 3248 37C9.tmp 100 PID 3248 wrote to memory of 5108 3248 37C9.tmp 100 PID 5108 wrote to memory of 4848 5108 3836.tmp 101 PID 5108 wrote to memory of 4848 5108 3836.tmp 101 PID 5108 wrote to memory of 4848 5108 3836.tmp 101 PID 4848 wrote to memory of 4976 4848 38A4.tmp 102 PID 4848 wrote to memory of 4976 4848 38A4.tmp 102 PID 4848 wrote to memory of 4976 4848 38A4.tmp 102 PID 4976 wrote to memory of 1496 4976 3911.tmp 103 PID 4976 wrote to memory of 1496 4976 3911.tmp 103 PID 4976 wrote to memory of 1496 4976 3911.tmp 103 PID 1496 wrote to memory of 2180 1496 39AD.tmp 104 PID 1496 wrote to memory of 2180 1496 39AD.tmp 104 PID 1496 wrote to memory of 2180 1496 39AD.tmp 104 PID 2180 wrote to memory of 1028 2180 3A0B.tmp 105 PID 2180 wrote to memory of 1028 2180 3A0B.tmp 105 PID 2180 wrote to memory of 1028 2180 3A0B.tmp 105 PID 1028 wrote to memory of 1392 1028 3A79.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\7070304b57e3f31a5f12c370129af0a0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Users\Admin\AppData\Local\Temp\3112.tmp"C:\Users\Admin\AppData\Local\Temp\3112.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\31BE.tmp"C:\Users\Admin\AppData\Local\Temp\31BE.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\324B.tmp"C:\Users\Admin\AppData\Local\Temp\324B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\32E7.tmp"C:\Users\Admin\AppData\Local\Temp\32E7.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\3354.tmp"C:\Users\Admin\AppData\Local\Temp\3354.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Users\Admin\AppData\Local\Temp\33C2.tmp"C:\Users\Admin\AppData\Local\Temp\33C2.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\344E.tmp"C:\Users\Admin\AppData\Local\Temp\344E.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:848 -
C:\Users\Admin\AppData\Local\Temp\34BC.tmp"C:\Users\Admin\AppData\Local\Temp\34BC.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\3539.tmp"C:\Users\Admin\AppData\Local\Temp\3539.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Users\Admin\AppData\Local\Temp\35B6.tmp"C:\Users\Admin\AppData\Local\Temp\35B6.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3244 -
C:\Users\Admin\AppData\Local\Temp\3642.tmp"C:\Users\Admin\AppData\Local\Temp\3642.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Users\Admin\AppData\Local\Temp\36A0.tmp"C:\Users\Admin\AppData\Local\Temp\36A0.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3048 -
C:\Users\Admin\AppData\Local\Temp\36FE.tmp"C:\Users\Admin\AppData\Local\Temp\36FE.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\375C.tmp"C:\Users\Admin\AppData\Local\Temp\375C.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\37C9.tmp"C:\Users\Admin\AppData\Local\Temp\37C9.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\3836.tmp"C:\Users\Admin\AppData\Local\Temp\3836.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\38A4.tmp"C:\Users\Admin\AppData\Local\Temp\38A4.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4848 -
C:\Users\Admin\AppData\Local\Temp\3911.tmp"C:\Users\Admin\AppData\Local\Temp\3911.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Users\Admin\AppData\Local\Temp\39AD.tmp"C:\Users\Admin\AppData\Local\Temp\39AD.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"C:\Users\Admin\AppData\Local\Temp\3A0B.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\3A79.tmp"C:\Users\Admin\AppData\Local\Temp\3A79.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"C:\Users\Admin\AppData\Local\Temp\3AC7.tmp"23⤵
- Executes dropped EXE
PID:1392 -
C:\Users\Admin\AppData\Local\Temp\3B53.tmp"C:\Users\Admin\AppData\Local\Temp\3B53.tmp"24⤵
- Executes dropped EXE
PID:3796 -
C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"C:\Users\Admin\AppData\Local\Temp\3BD0.tmp"25⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"C:\Users\Admin\AppData\Local\Temp\3C3E.tmp"26⤵
- Executes dropped EXE
PID:3040 -
C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"C:\Users\Admin\AppData\Local\Temp\3CDA.tmp"27⤵
- Executes dropped EXE
PID:1836 -
C:\Users\Admin\AppData\Local\Temp\3D38.tmp"C:\Users\Admin\AppData\Local\Temp\3D38.tmp"28⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\3D95.tmp"C:\Users\Admin\AppData\Local\Temp\3D95.tmp"29⤵
- Executes dropped EXE
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\3E22.tmp"C:\Users\Admin\AppData\Local\Temp\3E22.tmp"30⤵
- Executes dropped EXE
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"C:\Users\Admin\AppData\Local\Temp\3ECE.tmp"31⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"C:\Users\Admin\AppData\Local\Temp\3F3B.tmp"32⤵
- Executes dropped EXE
PID:4188 -
C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"C:\Users\Admin\AppData\Local\Temp\3FB8.tmp"33⤵
- Executes dropped EXE
PID:3212 -
C:\Users\Admin\AppData\Local\Temp\4035.tmp"C:\Users\Admin\AppData\Local\Temp\4035.tmp"34⤵
- Executes dropped EXE
PID:3612 -
C:\Users\Admin\AppData\Local\Temp\4083.tmp"C:\Users\Admin\AppData\Local\Temp\4083.tmp"35⤵
- Executes dropped EXE
PID:4684 -
C:\Users\Admin\AppData\Local\Temp\40D2.tmp"C:\Users\Admin\AppData\Local\Temp\40D2.tmp"36⤵
- Executes dropped EXE
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\412F.tmp"C:\Users\Admin\AppData\Local\Temp\412F.tmp"37⤵
- Executes dropped EXE
PID:3448 -
C:\Users\Admin\AppData\Local\Temp\417D.tmp"C:\Users\Admin\AppData\Local\Temp\417D.tmp"38⤵
- Executes dropped EXE
PID:884 -
C:\Users\Admin\AppData\Local\Temp\41CC.tmp"C:\Users\Admin\AppData\Local\Temp\41CC.tmp"39⤵
- Executes dropped EXE
PID:3804 -
C:\Users\Admin\AppData\Local\Temp\4229.tmp"C:\Users\Admin\AppData\Local\Temp\4229.tmp"40⤵
- Executes dropped EXE
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\4277.tmp"C:\Users\Admin\AppData\Local\Temp\4277.tmp"41⤵
- Executes dropped EXE
PID:4704 -
C:\Users\Admin\AppData\Local\Temp\42D5.tmp"C:\Users\Admin\AppData\Local\Temp\42D5.tmp"42⤵
- Executes dropped EXE
PID:4084 -
C:\Users\Admin\AppData\Local\Temp\4333.tmp"C:\Users\Admin\AppData\Local\Temp\4333.tmp"43⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\4391.tmp"C:\Users\Admin\AppData\Local\Temp\4391.tmp"44⤵
- Executes dropped EXE
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\43EE.tmp"C:\Users\Admin\AppData\Local\Temp\43EE.tmp"45⤵
- Executes dropped EXE
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\443D.tmp"C:\Users\Admin\AppData\Local\Temp\443D.tmp"46⤵
- Executes dropped EXE
PID:2644 -
C:\Users\Admin\AppData\Local\Temp\449A.tmp"C:\Users\Admin\AppData\Local\Temp\449A.tmp"47⤵
- Executes dropped EXE
PID:4024 -
C:\Users\Admin\AppData\Local\Temp\44F8.tmp"C:\Users\Admin\AppData\Local\Temp\44F8.tmp"48⤵
- Executes dropped EXE
PID:2788 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"49⤵
- Executes dropped EXE
PID:3248 -
C:\Users\Admin\AppData\Local\Temp\45B4.tmp"C:\Users\Admin\AppData\Local\Temp\45B4.tmp"50⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"51⤵
- Executes dropped EXE
PID:3540 -
C:\Users\Admin\AppData\Local\Temp\466F.tmp"C:\Users\Admin\AppData\Local\Temp\466F.tmp"52⤵
- Executes dropped EXE
PID:452 -
C:\Users\Admin\AppData\Local\Temp\46BD.tmp"C:\Users\Admin\AppData\Local\Temp\46BD.tmp"53⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\471B.tmp"C:\Users\Admin\AppData\Local\Temp\471B.tmp"54⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4779.tmp"C:\Users\Admin\AppData\Local\Temp\4779.tmp"55⤵
- Executes dropped EXE
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\47C7.tmp"C:\Users\Admin\AppData\Local\Temp\47C7.tmp"56⤵
- Executes dropped EXE
PID:2448 -
C:\Users\Admin\AppData\Local\Temp\4825.tmp"C:\Users\Admin\AppData\Local\Temp\4825.tmp"57⤵
- Executes dropped EXE
PID:3120 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"58⤵
- Executes dropped EXE
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\48F0.tmp"C:\Users\Admin\AppData\Local\Temp\48F0.tmp"59⤵
- Executes dropped EXE
PID:1328 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"60⤵
- Executes dropped EXE
PID:4928 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"61⤵
- Executes dropped EXE
PID:1772 -
C:\Users\Admin\AppData\Local\Temp\49F9.tmp"C:\Users\Admin\AppData\Local\Temp\49F9.tmp"62⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"63⤵
- Executes dropped EXE
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"64⤵
- Executes dropped EXE
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\4B22.tmp"C:\Users\Admin\AppData\Local\Temp\4B22.tmp"65⤵
- Executes dropped EXE
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"66⤵PID:1812
-
C:\Users\Admin\AppData\Local\Temp\4BED.tmp"C:\Users\Admin\AppData\Local\Temp\4BED.tmp"67⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"C:\Users\Admin\AppData\Local\Temp\4C4B.tmp"68⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"69⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\4D07.tmp"C:\Users\Admin\AppData\Local\Temp\4D07.tmp"70⤵PID:2948
-
C:\Users\Admin\AppData\Local\Temp\4D64.tmp"C:\Users\Admin\AppData\Local\Temp\4D64.tmp"71⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"C:\Users\Admin\AppData\Local\Temp\4DC2.tmp"72⤵PID:1140
-
C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"C:\Users\Admin\AppData\Local\Temp\4E2F.tmp"73⤵PID:3936
-
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"74⤵PID:4892
-
C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"C:\Users\Admin\AppData\Local\Temp\4EEB.tmp"75⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"76⤵PID:3060
-
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"77⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"78⤵PID:2276
-
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"79⤵PID:3124
-
C:\Users\Admin\AppData\Local\Temp\50C0.tmp"C:\Users\Admin\AppData\Local\Temp\50C0.tmp"80⤵PID:3092
-
C:\Users\Admin\AppData\Local\Temp\511D.tmp"C:\Users\Admin\AppData\Local\Temp\511D.tmp"81⤵PID:5016
-
C:\Users\Admin\AppData\Local\Temp\517B.tmp"C:\Users\Admin\AppData\Local\Temp\517B.tmp"82⤵PID:1720
-
C:\Users\Admin\AppData\Local\Temp\51D9.tmp"C:\Users\Admin\AppData\Local\Temp\51D9.tmp"83⤵PID:3516
-
C:\Users\Admin\AppData\Local\Temp\5237.tmp"C:\Users\Admin\AppData\Local\Temp\5237.tmp"84⤵PID:3500
-
C:\Users\Admin\AppData\Local\Temp\52A4.tmp"C:\Users\Admin\AppData\Local\Temp\52A4.tmp"85⤵PID:3132
-
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"86⤵PID:5112
-
C:\Users\Admin\AppData\Local\Temp\5360.tmp"C:\Users\Admin\AppData\Local\Temp\5360.tmp"87⤵PID:4896
-
C:\Users\Admin\AppData\Local\Temp\53CD.tmp"C:\Users\Admin\AppData\Local\Temp\53CD.tmp"88⤵PID:5044
-
C:\Users\Admin\AppData\Local\Temp\542B.tmp"C:\Users\Admin\AppData\Local\Temp\542B.tmp"89⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\5488.tmp"C:\Users\Admin\AppData\Local\Temp\5488.tmp"90⤵PID:1764
-
C:\Users\Admin\AppData\Local\Temp\54F6.tmp"C:\Users\Admin\AppData\Local\Temp\54F6.tmp"91⤵PID:5032
-
C:\Users\Admin\AppData\Local\Temp\5544.tmp"C:\Users\Admin\AppData\Local\Temp\5544.tmp"92⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\55A2.tmp"C:\Users\Admin\AppData\Local\Temp\55A2.tmp"93⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\55FF.tmp"C:\Users\Admin\AppData\Local\Temp\55FF.tmp"94⤵PID:4620
-
C:\Users\Admin\AppData\Local\Temp\565D.tmp"C:\Users\Admin\AppData\Local\Temp\565D.tmp"95⤵PID:4404
-
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"96⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\5719.tmp"C:\Users\Admin\AppData\Local\Temp\5719.tmp"97⤵PID:1820
-
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"98⤵PID:4508
-
C:\Users\Admin\AppData\Local\Temp\57D4.tmp"C:\Users\Admin\AppData\Local\Temp\57D4.tmp"99⤵PID:4092
-
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"100⤵PID:2720
-
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"101⤵PID:772
-
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"102⤵PID:1032
-
C:\Users\Admin\AppData\Local\Temp\592C.tmp"C:\Users\Admin\AppData\Local\Temp\592C.tmp"103⤵PID:2676
-
C:\Users\Admin\AppData\Local\Temp\598A.tmp"C:\Users\Admin\AppData\Local\Temp\598A.tmp"104⤵PID:2996
-
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"105⤵PID:1936
-
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"106⤵PID:4172
-
C:\Users\Admin\AppData\Local\Temp\5A93.tmp"C:\Users\Admin\AppData\Local\Temp\5A93.tmp"107⤵PID:4936
-
C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"C:\Users\Admin\AppData\Local\Temp\5AF1.tmp"108⤵PID:4044
-
C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"C:\Users\Admin\AppData\Local\Temp\5B4F.tmp"109⤵PID:3548
-
C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"C:\Users\Admin\AppData\Local\Temp\5B9D.tmp"110⤵PID:2212
-
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"111⤵PID:4192
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"112⤵PID:4204
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"113⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"114⤵PID:3836
-
C:\Users\Admin\AppData\Local\Temp\5D72.tmp"C:\Users\Admin\AppData\Local\Temp\5D72.tmp"115⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"C:\Users\Admin\AppData\Local\Temp\5DCF.tmp"116⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"C:\Users\Admin\AppData\Local\Temp\5E2D.tmp"117⤵PID:4300
-
C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"C:\Users\Admin\AppData\Local\Temp\5E7B.tmp"118⤵PID:4448
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"119⤵PID:3212
-
C:\Users\Admin\AppData\Local\Temp\5F18.tmp"C:\Users\Admin\AppData\Local\Temp\5F18.tmp"120⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5F66.tmp"C:\Users\Admin\AppData\Local\Temp\5F66.tmp"121⤵PID:1368
-
C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"C:\Users\Admin\AppData\Local\Temp\5FB4.tmp"122⤵PID:3512
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-