Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
30/05/2024, 03:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe
Resource
win7-20240419-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
2 signatures
150 seconds
General
-
Target
620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe
-
Size
530KB
-
MD5
620de2655c4e805d59a70bb35e29fed0
-
SHA1
70aab6455deafd0014b34a63a496fb4e0babcd9a
-
SHA256
03e19d73ff69c132646181af11a8fa65b37605eff2837ecea4f5f114a4c7ed7c
-
SHA512
01d51bbf3878f30575c2aaba99724b4cdeb967c4d48d6aca318c0b35c17e289193d7fb98716e24e48713e4d591189c0cc7cc14d969f3d51e678896fedf4e50bd
-
SSDEEP
12288:AU5rCOTeiobL7jm9vMSbJ5Hf9XmtJNZulFVg0M1:AUQOJobLwvnbr12tJNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 2548 4362.tmp 3292 43DF.tmp 1284 447B.tmp 1052 44D9.tmp 1300 4556.tmp 1228 45D3.tmp 2552 4631.tmp 3860 46CD.tmp 4608 472B.tmp 1768 47A8.tmp 5080 4815.tmp 3104 4882.tmp 3412 48E0.tmp 2724 494D.tmp 376 499C.tmp 1192 4A09.tmp 700 4A57.tmp 4328 4AC4.tmp 3636 4B41.tmp 1740 4BAF.tmp 2384 4C2C.tmp 1276 4CA9.tmp 3472 4D26.tmp 2152 4D93.tmp 3708 4E01.tmp 8 4E5E.tmp 3208 4EBC.tmp 440 4F1A.tmp 4760 4F68.tmp 3144 4FD5.tmp 3068 5052.tmp 2556 50DF.tmp 3012 515C.tmp 4332 51BA.tmp 2476 5208.tmp 3992 5266.tmp 1784 52C3.tmp 2956 5321.tmp 4876 536F.tmp 1052 53BD.tmp 3428 540B.tmp 3432 545A.tmp 1228 54B7.tmp 2028 5515.tmp 2528 5573.tmp 3444 55C1.tmp 4668 561F.tmp 3504 566D.tmp 3516 56CB.tmp 1212 5728.tmp 456 5776.tmp 1824 57C5.tmp 4548 5822.tmp 2524 5880.tmp 4632 58CE.tmp 5032 591C.tmp 1384 596A.tmp 4380 59C8.tmp 640 5A16.tmp 4504 5A64.tmp 3620 5AB3.tmp 540 5B10.tmp 3232 5B5E.tmp 1984 5BAD.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2548 2252 620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe 82 PID 2252 wrote to memory of 2548 2252 620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe 82 PID 2252 wrote to memory of 2548 2252 620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe 82 PID 2548 wrote to memory of 3292 2548 4362.tmp 83 PID 2548 wrote to memory of 3292 2548 4362.tmp 83 PID 2548 wrote to memory of 3292 2548 4362.tmp 83 PID 3292 wrote to memory of 1284 3292 43DF.tmp 84 PID 3292 wrote to memory of 1284 3292 43DF.tmp 84 PID 3292 wrote to memory of 1284 3292 43DF.tmp 84 PID 1284 wrote to memory of 1052 1284 447B.tmp 85 PID 1284 wrote to memory of 1052 1284 447B.tmp 85 PID 1284 wrote to memory of 1052 1284 447B.tmp 85 PID 1052 wrote to memory of 1300 1052 44D9.tmp 86 PID 1052 wrote to memory of 1300 1052 44D9.tmp 86 PID 1052 wrote to memory of 1300 1052 44D9.tmp 86 PID 1300 wrote to memory of 1228 1300 4556.tmp 88 PID 1300 wrote to memory of 1228 1300 4556.tmp 88 PID 1300 wrote to memory of 1228 1300 4556.tmp 88 PID 1228 wrote to memory of 2552 1228 45D3.tmp 89 PID 1228 wrote to memory of 2552 1228 45D3.tmp 89 PID 1228 wrote to memory of 2552 1228 45D3.tmp 89 PID 2552 wrote to memory of 3860 2552 4631.tmp 91 PID 2552 wrote to memory of 3860 2552 4631.tmp 91 PID 2552 wrote to memory of 3860 2552 4631.tmp 91 PID 3860 wrote to memory of 4608 3860 46CD.tmp 92 PID 3860 wrote to memory of 4608 3860 46CD.tmp 92 PID 3860 wrote to memory of 4608 3860 46CD.tmp 92 PID 4608 wrote to memory of 1768 4608 472B.tmp 94 PID 4608 wrote to memory of 1768 4608 472B.tmp 94 PID 4608 wrote to memory of 1768 4608 472B.tmp 94 PID 1768 wrote to memory of 5080 1768 47A8.tmp 95 PID 1768 wrote to memory of 5080 1768 47A8.tmp 95 PID 1768 wrote to memory of 5080 1768 47A8.tmp 95 PID 5080 wrote to memory of 3104 5080 4815.tmp 96 PID 5080 wrote to memory of 3104 5080 4815.tmp 96 PID 5080 wrote to memory of 3104 5080 4815.tmp 96 PID 3104 wrote to memory of 3412 3104 4882.tmp 97 PID 3104 wrote to memory of 3412 3104 4882.tmp 97 PID 3104 wrote to memory of 3412 3104 4882.tmp 97 PID 3412 wrote to memory of 2724 3412 48E0.tmp 98 PID 3412 wrote to memory of 2724 3412 48E0.tmp 98 PID 3412 wrote to memory of 2724 3412 48E0.tmp 98 PID 2724 wrote to memory of 376 2724 494D.tmp 99 PID 2724 wrote to memory of 376 2724 494D.tmp 99 PID 2724 wrote to memory of 376 2724 494D.tmp 99 PID 376 wrote to memory of 1192 376 499C.tmp 100 PID 376 wrote to memory of 1192 376 499C.tmp 100 PID 376 wrote to memory of 1192 376 499C.tmp 100 PID 1192 wrote to memory of 700 1192 4A09.tmp 101 PID 1192 wrote to memory of 700 1192 4A09.tmp 101 PID 1192 wrote to memory of 700 1192 4A09.tmp 101 PID 700 wrote to memory of 4328 700 4A57.tmp 102 PID 700 wrote to memory of 4328 700 4A57.tmp 102 PID 700 wrote to memory of 4328 700 4A57.tmp 102 PID 4328 wrote to memory of 3636 4328 4AC4.tmp 103 PID 4328 wrote to memory of 3636 4328 4AC4.tmp 103 PID 4328 wrote to memory of 3636 4328 4AC4.tmp 103 PID 3636 wrote to memory of 1740 3636 4B41.tmp 104 PID 3636 wrote to memory of 1740 3636 4B41.tmp 104 PID 3636 wrote to memory of 1740 3636 4B41.tmp 104 PID 1740 wrote to memory of 2384 1740 4BAF.tmp 105 PID 1740 wrote to memory of 2384 1740 4BAF.tmp 105 PID 1740 wrote to memory of 2384 1740 4BAF.tmp 105 PID 2384 wrote to memory of 1276 2384 4C2C.tmp 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\620de2655c4e805d59a70bb35e29fed0_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\4362.tmp"C:\Users\Admin\AppData\Local\Temp\4362.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Users\Admin\AppData\Local\Temp\43DF.tmp"C:\Users\Admin\AppData\Local\Temp\43DF.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3292 -
C:\Users\Admin\AppData\Local\Temp\447B.tmp"C:\Users\Admin\AppData\Local\Temp\447B.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\44D9.tmp"C:\Users\Admin\AppData\Local\Temp\44D9.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\4556.tmp"C:\Users\Admin\AppData\Local\Temp\4556.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\45D3.tmp"C:\Users\Admin\AppData\Local\Temp\45D3.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\4631.tmp"C:\Users\Admin\AppData\Local\Temp\4631.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Users\Admin\AppData\Local\Temp\46CD.tmp"C:\Users\Admin\AppData\Local\Temp\46CD.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Users\Admin\AppData\Local\Temp\472B.tmp"C:\Users\Admin\AppData\Local\Temp\472B.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Users\Admin\AppData\Local\Temp\47A8.tmp"C:\Users\Admin\AppData\Local\Temp\47A8.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\AppData\Local\Temp\4815.tmp"C:\Users\Admin\AppData\Local\Temp\4815.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Users\Admin\AppData\Local\Temp\4882.tmp"C:\Users\Admin\AppData\Local\Temp\4882.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\48E0.tmp"C:\Users\Admin\AppData\Local\Temp\48E0.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Local\Temp\494D.tmp"C:\Users\Admin\AppData\Local\Temp\494D.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\499C.tmp"C:\Users\Admin\AppData\Local\Temp\499C.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:376 -
C:\Users\Admin\AppData\Local\Temp\4A09.tmp"C:\Users\Admin\AppData\Local\Temp\4A09.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\4A57.tmp"C:\Users\Admin\AppData\Local\Temp\4A57.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:700 -
C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"C:\Users\Admin\AppData\Local\Temp\4AC4.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4328 -
C:\Users\Admin\AppData\Local\Temp\4B41.tmp"C:\Users\Admin\AppData\Local\Temp\4B41.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3636 -
C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"C:\Users\Admin\AppData\Local\Temp\4BAF.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1740 -
C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"C:\Users\Admin\AppData\Local\Temp\4C2C.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"C:\Users\Admin\AppData\Local\Temp\4CA9.tmp"23⤵
- Executes dropped EXE
PID:1276 -
C:\Users\Admin\AppData\Local\Temp\4D26.tmp"C:\Users\Admin\AppData\Local\Temp\4D26.tmp"24⤵
- Executes dropped EXE
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\4D93.tmp"C:\Users\Admin\AppData\Local\Temp\4D93.tmp"25⤵
- Executes dropped EXE
PID:2152 -
C:\Users\Admin\AppData\Local\Temp\4E01.tmp"C:\Users\Admin\AppData\Local\Temp\4E01.tmp"26⤵
- Executes dropped EXE
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"C:\Users\Admin\AppData\Local\Temp\4E5E.tmp"27⤵
- Executes dropped EXE
PID:8 -
C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"C:\Users\Admin\AppData\Local\Temp\4EBC.tmp"28⤵
- Executes dropped EXE
PID:3208 -
C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"C:\Users\Admin\AppData\Local\Temp\4F1A.tmp"29⤵
- Executes dropped EXE
PID:440 -
C:\Users\Admin\AppData\Local\Temp\4F68.tmp"C:\Users\Admin\AppData\Local\Temp\4F68.tmp"30⤵
- Executes dropped EXE
PID:4760 -
C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"C:\Users\Admin\AppData\Local\Temp\4FD5.tmp"31⤵
- Executes dropped EXE
PID:3144 -
C:\Users\Admin\AppData\Local\Temp\5052.tmp"C:\Users\Admin\AppData\Local\Temp\5052.tmp"32⤵
- Executes dropped EXE
PID:3068 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"33⤵
- Executes dropped EXE
PID:2556 -
C:\Users\Admin\AppData\Local\Temp\515C.tmp"C:\Users\Admin\AppData\Local\Temp\515C.tmp"34⤵
- Executes dropped EXE
PID:3012 -
C:\Users\Admin\AppData\Local\Temp\51BA.tmp"C:\Users\Admin\AppData\Local\Temp\51BA.tmp"35⤵
- Executes dropped EXE
PID:4332 -
C:\Users\Admin\AppData\Local\Temp\5208.tmp"C:\Users\Admin\AppData\Local\Temp\5208.tmp"36⤵
- Executes dropped EXE
PID:2476 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"37⤵
- Executes dropped EXE
PID:3992 -
C:\Users\Admin\AppData\Local\Temp\52C3.tmp"C:\Users\Admin\AppData\Local\Temp\52C3.tmp"38⤵
- Executes dropped EXE
PID:1784 -
C:\Users\Admin\AppData\Local\Temp\5321.tmp"C:\Users\Admin\AppData\Local\Temp\5321.tmp"39⤵
- Executes dropped EXE
PID:2956 -
C:\Users\Admin\AppData\Local\Temp\536F.tmp"C:\Users\Admin\AppData\Local\Temp\536F.tmp"40⤵
- Executes dropped EXE
PID:4876 -
C:\Users\Admin\AppData\Local\Temp\53BD.tmp"C:\Users\Admin\AppData\Local\Temp\53BD.tmp"41⤵
- Executes dropped EXE
PID:1052 -
C:\Users\Admin\AppData\Local\Temp\540B.tmp"C:\Users\Admin\AppData\Local\Temp\540B.tmp"42⤵
- Executes dropped EXE
PID:3428 -
C:\Users\Admin\AppData\Local\Temp\545A.tmp"C:\Users\Admin\AppData\Local\Temp\545A.tmp"43⤵
- Executes dropped EXE
PID:3432 -
C:\Users\Admin\AppData\Local\Temp\54B7.tmp"C:\Users\Admin\AppData\Local\Temp\54B7.tmp"44⤵
- Executes dropped EXE
PID:1228 -
C:\Users\Admin\AppData\Local\Temp\5515.tmp"C:\Users\Admin\AppData\Local\Temp\5515.tmp"45⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\5573.tmp"C:\Users\Admin\AppData\Local\Temp\5573.tmp"46⤵
- Executes dropped EXE
PID:2528 -
C:\Users\Admin\AppData\Local\Temp\55C1.tmp"C:\Users\Admin\AppData\Local\Temp\55C1.tmp"47⤵
- Executes dropped EXE
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"48⤵
- Executes dropped EXE
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"49⤵
- Executes dropped EXE
PID:3504 -
C:\Users\Admin\AppData\Local\Temp\56CB.tmp"C:\Users\Admin\AppData\Local\Temp\56CB.tmp"50⤵
- Executes dropped EXE
PID:3516 -
C:\Users\Admin\AppData\Local\Temp\5728.tmp"C:\Users\Admin\AppData\Local\Temp\5728.tmp"51⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\5776.tmp"C:\Users\Admin\AppData\Local\Temp\5776.tmp"52⤵
- Executes dropped EXE
PID:456 -
C:\Users\Admin\AppData\Local\Temp\57C5.tmp"C:\Users\Admin\AppData\Local\Temp\57C5.tmp"53⤵
- Executes dropped EXE
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\5822.tmp"C:\Users\Admin\AppData\Local\Temp\5822.tmp"54⤵
- Executes dropped EXE
PID:4548 -
C:\Users\Admin\AppData\Local\Temp\5880.tmp"C:\Users\Admin\AppData\Local\Temp\5880.tmp"55⤵
- Executes dropped EXE
PID:2524 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"56⤵
- Executes dropped EXE
PID:4632 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"57⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\596A.tmp"C:\Users\Admin\AppData\Local\Temp\596A.tmp"58⤵
- Executes dropped EXE
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\59C8.tmp"C:\Users\Admin\AppData\Local\Temp\59C8.tmp"59⤵
- Executes dropped EXE
PID:4380 -
C:\Users\Admin\AppData\Local\Temp\5A16.tmp"C:\Users\Admin\AppData\Local\Temp\5A16.tmp"60⤵
- Executes dropped EXE
PID:640 -
C:\Users\Admin\AppData\Local\Temp\5A64.tmp"C:\Users\Admin\AppData\Local\Temp\5A64.tmp"61⤵
- Executes dropped EXE
PID:4504 -
C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"C:\Users\Admin\AppData\Local\Temp\5AB3.tmp"62⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\5B10.tmp"C:\Users\Admin\AppData\Local\Temp\5B10.tmp"63⤵
- Executes dropped EXE
PID:540 -
C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"C:\Users\Admin\AppData\Local\Temp\5B5E.tmp"64⤵
- Executes dropped EXE
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"C:\Users\Admin\AppData\Local\Temp\5BAD.tmp"65⤵
- Executes dropped EXE
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"C:\Users\Admin\AppData\Local\Temp\5C0A.tmp"66⤵PID:3552
-
C:\Users\Admin\AppData\Local\Temp\5C68.tmp"C:\Users\Admin\AppData\Local\Temp\5C68.tmp"67⤵PID:5052
-
C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"C:\Users\Admin\AppData\Local\Temp\5CB6.tmp"68⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5D14.tmp"C:\Users\Admin\AppData\Local\Temp\5D14.tmp"69⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\5D62.tmp"C:\Users\Admin\AppData\Local\Temp\5D62.tmp"70⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"C:\Users\Admin\AppData\Local\Temp\5DC0.tmp"71⤵PID:4536
-
C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"C:\Users\Admin\AppData\Local\Temp\5E0E.tmp"72⤵PID:3980
-
C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"C:\Users\Admin\AppData\Local\Temp\5E5C.tmp"73⤵PID:8
-
C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"C:\Users\Admin\AppData\Local\Temp\5EC9.tmp"74⤵PID:1968
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"75⤵PID:2156
-
C:\Users\Admin\AppData\Local\Temp\5F85.tmp"C:\Users\Admin\AppData\Local\Temp\5F85.tmp"76⤵PID:4844
-
C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"C:\Users\Admin\AppData\Local\Temp\5FE3.tmp"77⤵PID:4760
-
C:\Users\Admin\AppData\Local\Temp\6040.tmp"C:\Users\Admin\AppData\Local\Temp\6040.tmp"78⤵PID:4400
-
C:\Users\Admin\AppData\Local\Temp\609E.tmp"C:\Users\Admin\AppData\Local\Temp\609E.tmp"79⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\60EC.tmp"C:\Users\Admin\AppData\Local\Temp\60EC.tmp"80⤵PID:3068
-
C:\Users\Admin\AppData\Local\Temp\614A.tmp"C:\Users\Admin\AppData\Local\Temp\614A.tmp"81⤵PID:2556
-
C:\Users\Admin\AppData\Local\Temp\61A8.tmp"C:\Users\Admin\AppData\Local\Temp\61A8.tmp"82⤵PID:3056
-
C:\Users\Admin\AppData\Local\Temp\6206.tmp"C:\Users\Admin\AppData\Local\Temp\6206.tmp"83⤵PID:4332
-
C:\Users\Admin\AppData\Local\Temp\6254.tmp"C:\Users\Admin\AppData\Local\Temp\6254.tmp"84⤵PID:2476
-
C:\Users\Admin\AppData\Local\Temp\62B1.tmp"C:\Users\Admin\AppData\Local\Temp\62B1.tmp"85⤵PID:3992
-
C:\Users\Admin\AppData\Local\Temp\630F.tmp"C:\Users\Admin\AppData\Local\Temp\630F.tmp"86⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"87⤵PID:2956
-
C:\Users\Admin\AppData\Local\Temp\63BB.tmp"C:\Users\Admin\AppData\Local\Temp\63BB.tmp"88⤵PID:432
-
C:\Users\Admin\AppData\Local\Temp\6419.tmp"C:\Users\Admin\AppData\Local\Temp\6419.tmp"89⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\6477.tmp"C:\Users\Admin\AppData\Local\Temp\6477.tmp"90⤵PID:3524
-
C:\Users\Admin\AppData\Local\Temp\64D4.tmp"C:\Users\Admin\AppData\Local\Temp\64D4.tmp"91⤵PID:2364
-
C:\Users\Admin\AppData\Local\Temp\6522.tmp"C:\Users\Admin\AppData\Local\Temp\6522.tmp"92⤵PID:4820
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"93⤵PID:768
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"94⤵PID:1492
-
C:\Users\Admin\AppData\Local\Temp\663C.tmp"C:\Users\Admin\AppData\Local\Temp\663C.tmp"95⤵PID:4420
-
C:\Users\Admin\AppData\Local\Temp\6699.tmp"C:\Users\Admin\AppData\Local\Temp\6699.tmp"96⤵PID:2552
-
C:\Users\Admin\AppData\Local\Temp\66F7.tmp"C:\Users\Admin\AppData\Local\Temp\66F7.tmp"97⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\6755.tmp"C:\Users\Admin\AppData\Local\Temp\6755.tmp"98⤵PID:2260
-
C:\Users\Admin\AppData\Local\Temp\67B3.tmp"C:\Users\Admin\AppData\Local\Temp\67B3.tmp"99⤵PID:3740
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"100⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"101⤵PID:4608
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"102⤵PID:2880
-
C:\Users\Admin\AppData\Local\Temp\692A.tmp"C:\Users\Admin\AppData\Local\Temp\692A.tmp"103⤵PID:3104
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"104⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\69C6.tmp"C:\Users\Admin\AppData\Local\Temp\69C6.tmp"105⤵PID:4660
-
C:\Users\Admin\AppData\Local\Temp\6A14.tmp"C:\Users\Admin\AppData\Local\Temp\6A14.tmp"106⤵PID:2372
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"107⤵PID:3848
-
C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"C:\Users\Admin\AppData\Local\Temp\6AD0.tmp"108⤵PID:4328
-
C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"C:\Users\Admin\AppData\Local\Temp\6B2D.tmp"109⤵PID:4772
-
C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"C:\Users\Admin\AppData\Local\Temp\6B8B.tmp"110⤵PID:336
-
C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"C:\Users\Admin\AppData\Local\Temp\6BD9.tmp"111⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\6C37.tmp"C:\Users\Admin\AppData\Local\Temp\6C37.tmp"112⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\6C95.tmp"C:\Users\Admin\AppData\Local\Temp\6C95.tmp"113⤵PID:2456
-
C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"C:\Users\Admin\AppData\Local\Temp\6CE3.tmp"114⤵PID:4884
-
C:\Users\Admin\AppData\Local\Temp\6D31.tmp"C:\Users\Admin\AppData\Local\Temp\6D31.tmp"115⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"C:\Users\Admin\AppData\Local\Temp\6D8F.tmp"116⤵PID:4076
-
C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"C:\Users\Admin\AppData\Local\Temp\6DEC.tmp"117⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"C:\Users\Admin\AppData\Local\Temp\6E4A.tmp"118⤵PID:1904
-
C:\Users\Admin\AppData\Local\Temp\6E98.tmp"C:\Users\Admin\AppData\Local\Temp\6E98.tmp"119⤵PID:2332
-
C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"C:\Users\Admin\AppData\Local\Temp\6EF6.tmp"120⤵PID:5072
-
C:\Users\Admin\AppData\Local\Temp\6F44.tmp"C:\Users\Admin\AppData\Local\Temp\6F44.tmp"121⤵PID:820
-
C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"C:\Users\Admin\AppData\Local\Temp\6FA2.tmp"122⤵PID:3156
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-