Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11-06-2024 01:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe
Resource
win7-20240220-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe
-
Size
530KB
-
MD5
227d6eff4c79d95a6b9f10a5bb02ad20
-
SHA1
826d2c43d44a24feab2204b5701928df798333dc
-
SHA256
34790ff65d7816b0d7fa962b84f759e5b1883452306814f3acf68c8eac291dea
-
SHA512
aad3c1649f7f3c720ea29dd324659a62fc3c3677ea0c0d95600af0f947fd28f7dc6db63920299eebe36383ecc85fb56eca2888f16c26e1328b598f699d009e58
-
SSDEEP
12288:AU5rCOTeiosD3h00oZQduoP5HDRwNZulFVg0M1:AUQOJo6R00oZds5HDRwNclFV/M1
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 1120 44AA.tmp 3872 4537.tmp 3220 4594.tmp 2304 4611.tmp 4344 468E.tmp 3104 470B.tmp 4228 4798.tmp 3096 4805.tmp 2828 4863.tmp 2364 48D0.tmp 2572 491F.tmp 4836 498C.tmp 4112 49EA.tmp 384 4A38.tmp 5084 4AB5.tmp 4276 4B13.tmp 4524 4B80.tmp 1248 4BFD.tmp 688 4C5B.tmp 4772 4CD8.tmp 1984 4D35.tmp 4408 4DA3.tmp 4964 4E10.tmp 2028 4E8D.tmp 3724 4EFB.tmp 3080 4F49.tmp 2336 4FA6.tmp 1240 5004.tmp 4164 5062.tmp 2800 50DF.tmp 1720 512D.tmp 1548 51AA.tmp 2064 5217.tmp 3736 5266.tmp 1416 52B4.tmp 4792 5302.tmp 1680 5350.tmp 1688 539E.tmp 2104 53EC.tmp 1368 543A.tmp 1156 5498.tmp 2396 54E6.tmp 992 5534.tmp 2740 5582.tmp 3552 55D1.tmp 5024 561F.tmp 4840 566D.tmp 3740 56BB.tmp 2016 5709.tmp 4776 5767.tmp 2984 57B5.tmp 3284 5813.tmp 3052 5870.tmp 3300 58CE.tmp 3832 591C.tmp 2496 597A.tmp 1516 59D8.tmp 408 5A36.tmp 4648 5A84.tmp 2008 5AD2.tmp 4208 5B30.tmp 1968 5B7E.tmp 2432 5BDB.tmp 516 5C39.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4780 wrote to memory of 1120 4780 227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe 80 PID 4780 wrote to memory of 1120 4780 227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe 80 PID 4780 wrote to memory of 1120 4780 227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe 80 PID 1120 wrote to memory of 3872 1120 44AA.tmp 81 PID 1120 wrote to memory of 3872 1120 44AA.tmp 81 PID 1120 wrote to memory of 3872 1120 44AA.tmp 81 PID 3872 wrote to memory of 3220 3872 4537.tmp 82 PID 3872 wrote to memory of 3220 3872 4537.tmp 82 PID 3872 wrote to memory of 3220 3872 4537.tmp 82 PID 3220 wrote to memory of 2304 3220 4594.tmp 83 PID 3220 wrote to memory of 2304 3220 4594.tmp 83 PID 3220 wrote to memory of 2304 3220 4594.tmp 83 PID 2304 wrote to memory of 4344 2304 4611.tmp 84 PID 2304 wrote to memory of 4344 2304 4611.tmp 84 PID 2304 wrote to memory of 4344 2304 4611.tmp 84 PID 4344 wrote to memory of 3104 4344 468E.tmp 85 PID 4344 wrote to memory of 3104 4344 468E.tmp 85 PID 4344 wrote to memory of 3104 4344 468E.tmp 85 PID 3104 wrote to memory of 4228 3104 470B.tmp 86 PID 3104 wrote to memory of 4228 3104 470B.tmp 86 PID 3104 wrote to memory of 4228 3104 470B.tmp 86 PID 4228 wrote to memory of 3096 4228 4798.tmp 87 PID 4228 wrote to memory of 3096 4228 4798.tmp 87 PID 4228 wrote to memory of 3096 4228 4798.tmp 87 PID 3096 wrote to memory of 2828 3096 4805.tmp 88 PID 3096 wrote to memory of 2828 3096 4805.tmp 88 PID 3096 wrote to memory of 2828 3096 4805.tmp 88 PID 2828 wrote to memory of 2364 2828 4863.tmp 89 PID 2828 wrote to memory of 2364 2828 4863.tmp 89 PID 2828 wrote to memory of 2364 2828 4863.tmp 89 PID 2364 wrote to memory of 2572 2364 48D0.tmp 90 PID 2364 wrote to memory of 2572 2364 48D0.tmp 90 PID 2364 wrote to memory of 2572 2364 48D0.tmp 90 PID 2572 wrote to memory of 4836 2572 491F.tmp 91 PID 2572 wrote to memory of 4836 2572 491F.tmp 91 PID 2572 wrote to memory of 4836 2572 491F.tmp 91 PID 4836 wrote to memory of 4112 4836 498C.tmp 92 PID 4836 wrote to memory of 4112 4836 498C.tmp 92 PID 4836 wrote to memory of 4112 4836 498C.tmp 92 PID 4112 wrote to memory of 384 4112 49EA.tmp 93 PID 4112 wrote to memory of 384 4112 49EA.tmp 93 PID 4112 wrote to memory of 384 4112 49EA.tmp 93 PID 384 wrote to memory of 5084 384 4A38.tmp 94 PID 384 wrote to memory of 5084 384 4A38.tmp 94 PID 384 wrote to memory of 5084 384 4A38.tmp 94 PID 5084 wrote to memory of 4276 5084 4AB5.tmp 95 PID 5084 wrote to memory of 4276 5084 4AB5.tmp 95 PID 5084 wrote to memory of 4276 5084 4AB5.tmp 95 PID 4276 wrote to memory of 4524 4276 4B13.tmp 96 PID 4276 wrote to memory of 4524 4276 4B13.tmp 96 PID 4276 wrote to memory of 4524 4276 4B13.tmp 96 PID 4524 wrote to memory of 1248 4524 4B80.tmp 97 PID 4524 wrote to memory of 1248 4524 4B80.tmp 97 PID 4524 wrote to memory of 1248 4524 4B80.tmp 97 PID 1248 wrote to memory of 688 1248 4BFD.tmp 98 PID 1248 wrote to memory of 688 1248 4BFD.tmp 98 PID 1248 wrote to memory of 688 1248 4BFD.tmp 98 PID 688 wrote to memory of 4772 688 4C5B.tmp 99 PID 688 wrote to memory of 4772 688 4C5B.tmp 99 PID 688 wrote to memory of 4772 688 4C5B.tmp 99 PID 4772 wrote to memory of 1984 4772 4CD8.tmp 100 PID 4772 wrote to memory of 1984 4772 4CD8.tmp 100 PID 4772 wrote to memory of 1984 4772 4CD8.tmp 100 PID 1984 wrote to memory of 4408 1984 4D35.tmp 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe"C:\Users\Admin\AppData\Local\Temp\227d6eff4c79d95a6b9f10a5bb02ad20_NeikiAnalytics.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\44AA.tmp"C:\Users\Admin\AppData\Local\Temp\44AA.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Users\Admin\AppData\Local\Temp\4537.tmp"C:\Users\Admin\AppData\Local\Temp\4537.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\4594.tmp"C:\Users\Admin\AppData\Local\Temp\4594.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Users\Admin\AppData\Local\Temp\4611.tmp"C:\Users\Admin\AppData\Local\Temp\4611.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Users\Admin\AppData\Local\Temp\468E.tmp"C:\Users\Admin\AppData\Local\Temp\468E.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Local\Temp\470B.tmp"C:\Users\Admin\AppData\Local\Temp\470B.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3104 -
C:\Users\Admin\AppData\Local\Temp\4798.tmp"C:\Users\Admin\AppData\Local\Temp\4798.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4228 -
C:\Users\Admin\AppData\Local\Temp\4805.tmp"C:\Users\Admin\AppData\Local\Temp\4805.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\4863.tmp"C:\Users\Admin\AppData\Local\Temp\4863.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2828 -
C:\Users\Admin\AppData\Local\Temp\48D0.tmp"C:\Users\Admin\AppData\Local\Temp\48D0.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\491F.tmp"C:\Users\Admin\AppData\Local\Temp\491F.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\498C.tmp"C:\Users\Admin\AppData\Local\Temp\498C.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\49EA.tmp"C:\Users\Admin\AppData\Local\Temp\49EA.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Local\Temp\4A38.tmp"C:\Users\Admin\AppData\Local\Temp\4A38.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"C:\Users\Admin\AppData\Local\Temp\4AB5.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Users\Admin\AppData\Local\Temp\4B13.tmp"C:\Users\Admin\AppData\Local\Temp\4B13.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4276 -
C:\Users\Admin\AppData\Local\Temp\4B80.tmp"C:\Users\Admin\AppData\Local\Temp\4B80.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"C:\Users\Admin\AppData\Local\Temp\4BFD.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"C:\Users\Admin\AppData\Local\Temp\4C5B.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"C:\Users\Admin\AppData\Local\Temp\4CD8.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\4D35.tmp"C:\Users\Admin\AppData\Local\Temp\4D35.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"C:\Users\Admin\AppData\Local\Temp\4DA3.tmp"23⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\4E10.tmp"C:\Users\Admin\AppData\Local\Temp\4E10.tmp"24⤵
- Executes dropped EXE
PID:4964 -
C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"C:\Users\Admin\AppData\Local\Temp\4E8D.tmp"25⤵
- Executes dropped EXE
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"C:\Users\Admin\AppData\Local\Temp\4EFB.tmp"26⤵
- Executes dropped EXE
PID:3724 -
C:\Users\Admin\AppData\Local\Temp\4F49.tmp"C:\Users\Admin\AppData\Local\Temp\4F49.tmp"27⤵
- Executes dropped EXE
PID:3080 -
C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"C:\Users\Admin\AppData\Local\Temp\4FA6.tmp"28⤵
- Executes dropped EXE
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\5004.tmp"C:\Users\Admin\AppData\Local\Temp\5004.tmp"29⤵
- Executes dropped EXE
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\5062.tmp"C:\Users\Admin\AppData\Local\Temp\5062.tmp"30⤵
- Executes dropped EXE
PID:4164 -
C:\Users\Admin\AppData\Local\Temp\50DF.tmp"C:\Users\Admin\AppData\Local\Temp\50DF.tmp"31⤵
- Executes dropped EXE
PID:2800 -
C:\Users\Admin\AppData\Local\Temp\512D.tmp"C:\Users\Admin\AppData\Local\Temp\512D.tmp"32⤵
- Executes dropped EXE
PID:1720 -
C:\Users\Admin\AppData\Local\Temp\51AA.tmp"C:\Users\Admin\AppData\Local\Temp\51AA.tmp"33⤵
- Executes dropped EXE
PID:1548 -
C:\Users\Admin\AppData\Local\Temp\5217.tmp"C:\Users\Admin\AppData\Local\Temp\5217.tmp"34⤵
- Executes dropped EXE
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\5266.tmp"C:\Users\Admin\AppData\Local\Temp\5266.tmp"35⤵
- Executes dropped EXE
PID:3736 -
C:\Users\Admin\AppData\Local\Temp\52B4.tmp"C:\Users\Admin\AppData\Local\Temp\52B4.tmp"36⤵
- Executes dropped EXE
PID:1416 -
C:\Users\Admin\AppData\Local\Temp\5302.tmp"C:\Users\Admin\AppData\Local\Temp\5302.tmp"37⤵
- Executes dropped EXE
PID:4792 -
C:\Users\Admin\AppData\Local\Temp\5350.tmp"C:\Users\Admin\AppData\Local\Temp\5350.tmp"38⤵
- Executes dropped EXE
PID:1680 -
C:\Users\Admin\AppData\Local\Temp\539E.tmp"C:\Users\Admin\AppData\Local\Temp\539E.tmp"39⤵
- Executes dropped EXE
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\53EC.tmp"C:\Users\Admin\AppData\Local\Temp\53EC.tmp"40⤵
- Executes dropped EXE
PID:2104 -
C:\Users\Admin\AppData\Local\Temp\543A.tmp"C:\Users\Admin\AppData\Local\Temp\543A.tmp"41⤵
- Executes dropped EXE
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\5498.tmp"C:\Users\Admin\AppData\Local\Temp\5498.tmp"42⤵
- Executes dropped EXE
PID:1156 -
C:\Users\Admin\AppData\Local\Temp\54E6.tmp"C:\Users\Admin\AppData\Local\Temp\54E6.tmp"43⤵
- Executes dropped EXE
PID:2396 -
C:\Users\Admin\AppData\Local\Temp\5534.tmp"C:\Users\Admin\AppData\Local\Temp\5534.tmp"44⤵
- Executes dropped EXE
PID:992 -
C:\Users\Admin\AppData\Local\Temp\5582.tmp"C:\Users\Admin\AppData\Local\Temp\5582.tmp"45⤵
- Executes dropped EXE
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\55D1.tmp"C:\Users\Admin\AppData\Local\Temp\55D1.tmp"46⤵
- Executes dropped EXE
PID:3552 -
C:\Users\Admin\AppData\Local\Temp\561F.tmp"C:\Users\Admin\AppData\Local\Temp\561F.tmp"47⤵
- Executes dropped EXE
PID:5024 -
C:\Users\Admin\AppData\Local\Temp\566D.tmp"C:\Users\Admin\AppData\Local\Temp\566D.tmp"48⤵
- Executes dropped EXE
PID:4840 -
C:\Users\Admin\AppData\Local\Temp\56BB.tmp"C:\Users\Admin\AppData\Local\Temp\56BB.tmp"49⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\5709.tmp"C:\Users\Admin\AppData\Local\Temp\5709.tmp"50⤵
- Executes dropped EXE
PID:2016 -
C:\Users\Admin\AppData\Local\Temp\5767.tmp"C:\Users\Admin\AppData\Local\Temp\5767.tmp"51⤵
- Executes dropped EXE
PID:4776 -
C:\Users\Admin\AppData\Local\Temp\57B5.tmp"C:\Users\Admin\AppData\Local\Temp\57B5.tmp"52⤵
- Executes dropped EXE
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\5813.tmp"C:\Users\Admin\AppData\Local\Temp\5813.tmp"53⤵
- Executes dropped EXE
PID:3284 -
C:\Users\Admin\AppData\Local\Temp\5870.tmp"C:\Users\Admin\AppData\Local\Temp\5870.tmp"54⤵
- Executes dropped EXE
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\58CE.tmp"C:\Users\Admin\AppData\Local\Temp\58CE.tmp"55⤵
- Executes dropped EXE
PID:3300 -
C:\Users\Admin\AppData\Local\Temp\591C.tmp"C:\Users\Admin\AppData\Local\Temp\591C.tmp"56⤵
- Executes dropped EXE
PID:3832 -
C:\Users\Admin\AppData\Local\Temp\597A.tmp"C:\Users\Admin\AppData\Local\Temp\597A.tmp"57⤵
- Executes dropped EXE
PID:2496 -
C:\Users\Admin\AppData\Local\Temp\59D8.tmp"C:\Users\Admin\AppData\Local\Temp\59D8.tmp"58⤵
- Executes dropped EXE
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\5A36.tmp"C:\Users\Admin\AppData\Local\Temp\5A36.tmp"59⤵
- Executes dropped EXE
PID:408 -
C:\Users\Admin\AppData\Local\Temp\5A84.tmp"C:\Users\Admin\AppData\Local\Temp\5A84.tmp"60⤵
- Executes dropped EXE
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"C:\Users\Admin\AppData\Local\Temp\5AD2.tmp"61⤵
- Executes dropped EXE
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\5B30.tmp"C:\Users\Admin\AppData\Local\Temp\5B30.tmp"62⤵
- Executes dropped EXE
PID:4208 -
C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"C:\Users\Admin\AppData\Local\Temp\5B7E.tmp"63⤵
- Executes dropped EXE
PID:1968 -
C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"C:\Users\Admin\AppData\Local\Temp\5BDB.tmp"64⤵
- Executes dropped EXE
PID:2432 -
C:\Users\Admin\AppData\Local\Temp\5C39.tmp"C:\Users\Admin\AppData\Local\Temp\5C39.tmp"65⤵
- Executes dropped EXE
PID:516 -
C:\Users\Admin\AppData\Local\Temp\5C87.tmp"C:\Users\Admin\AppData\Local\Temp\5C87.tmp"66⤵PID:4160
-
C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"C:\Users\Admin\AppData\Local\Temp\5CE5.tmp"67⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\5D33.tmp"C:\Users\Admin\AppData\Local\Temp\5D33.tmp"68⤵PID:3156
-
C:\Users\Admin\AppData\Local\Temp\5D81.tmp"C:\Users\Admin\AppData\Local\Temp\5D81.tmp"69⤵PID:3120
-
C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"C:\Users\Admin\AppData\Local\Temp\5DDF.tmp"70⤵PID:4636
-
C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"C:\Users\Admin\AppData\Local\Temp\5E3D.tmp"71⤵PID:4908
-
C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"C:\Users\Admin\AppData\Local\Temp\5E8B.tmp"72⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"C:\Users\Admin\AppData\Local\Temp\5ED9.tmp"73⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\5F27.tmp"C:\Users\Admin\AppData\Local\Temp\5F27.tmp"74⤵PID:4336
-
C:\Users\Admin\AppData\Local\Temp\5F75.tmp"C:\Users\Admin\AppData\Local\Temp\5F75.tmp"75⤵PID:4780
-
C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"C:\Users\Admin\AppData\Local\Temp\5FC3.tmp"76⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\6021.tmp"C:\Users\Admin\AppData\Local\Temp\6021.tmp"77⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\607F.tmp"C:\Users\Admin\AppData\Local\Temp\607F.tmp"78⤵PID:1316
-
C:\Users\Admin\AppData\Local\Temp\60DD.tmp"C:\Users\Admin\AppData\Local\Temp\60DD.tmp"79⤵PID:404
-
C:\Users\Admin\AppData\Local\Temp\612B.tmp"C:\Users\Admin\AppData\Local\Temp\612B.tmp"80⤵PID:3016
-
C:\Users\Admin\AppData\Local\Temp\6179.tmp"C:\Users\Admin\AppData\Local\Temp\6179.tmp"81⤵PID:3488
-
C:\Users\Admin\AppData\Local\Temp\61C7.tmp"C:\Users\Admin\AppData\Local\Temp\61C7.tmp"82⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\6225.tmp"C:\Users\Admin\AppData\Local\Temp\6225.tmp"83⤵PID:4344
-
C:\Users\Admin\AppData\Local\Temp\6273.tmp"C:\Users\Admin\AppData\Local\Temp\6273.tmp"84⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\62C1.tmp"C:\Users\Admin\AppData\Local\Temp\62C1.tmp"85⤵PID:3640
-
C:\Users\Admin\AppData\Local\Temp\631F.tmp"C:\Users\Admin\AppData\Local\Temp\631F.tmp"86⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\636D.tmp"C:\Users\Admin\AppData\Local\Temp\636D.tmp"87⤵PID:4036
-
C:\Users\Admin\AppData\Local\Temp\63CB.tmp"C:\Users\Admin\AppData\Local\Temp\63CB.tmp"88⤵PID:2288
-
C:\Users\Admin\AppData\Local\Temp\6428.tmp"C:\Users\Admin\AppData\Local\Temp\6428.tmp"89⤵PID:1932
-
C:\Users\Admin\AppData\Local\Temp\6486.tmp"C:\Users\Admin\AppData\Local\Temp\6486.tmp"90⤵PID:4976
-
C:\Users\Admin\AppData\Local\Temp\64E4.tmp"C:\Users\Admin\AppData\Local\Temp\64E4.tmp"91⤵PID:4392
-
C:\Users\Admin\AppData\Local\Temp\6532.tmp"C:\Users\Admin\AppData\Local\Temp\6532.tmp"92⤵PID:908
-
C:\Users\Admin\AppData\Local\Temp\6580.tmp"C:\Users\Admin\AppData\Local\Temp\6580.tmp"93⤵PID:760
-
C:\Users\Admin\AppData\Local\Temp\65DE.tmp"C:\Users\Admin\AppData\Local\Temp\65DE.tmp"94⤵PID:4112
-
C:\Users\Admin\AppData\Local\Temp\662C.tmp"C:\Users\Admin\AppData\Local\Temp\662C.tmp"95⤵PID:3584
-
C:\Users\Admin\AppData\Local\Temp\667A.tmp"C:\Users\Admin\AppData\Local\Temp\667A.tmp"96⤵PID:4484
-
C:\Users\Admin\AppData\Local\Temp\66C8.tmp"C:\Users\Admin\AppData\Local\Temp\66C8.tmp"97⤵PID:1860
-
C:\Users\Admin\AppData\Local\Temp\6716.tmp"C:\Users\Admin\AppData\Local\Temp\6716.tmp"98⤵PID:2744
-
C:\Users\Admin\AppData\Local\Temp\6765.tmp"C:\Users\Admin\AppData\Local\Temp\6765.tmp"99⤵PID:1100
-
C:\Users\Admin\AppData\Local\Temp\67C2.tmp"C:\Users\Admin\AppData\Local\Temp\67C2.tmp"100⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\6810.tmp"C:\Users\Admin\AppData\Local\Temp\6810.tmp"101⤵PID:1748
-
C:\Users\Admin\AppData\Local\Temp\686E.tmp"C:\Users\Admin\AppData\Local\Temp\686E.tmp"102⤵PID:3388
-
C:\Users\Admin\AppData\Local\Temp\68CC.tmp"C:\Users\Admin\AppData\Local\Temp\68CC.tmp"103⤵PID:5040
-
C:\Users\Admin\AppData\Local\Temp\691A.tmp"C:\Users\Admin\AppData\Local\Temp\691A.tmp"104⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\6978.tmp"C:\Users\Admin\AppData\Local\Temp\6978.tmp"105⤵PID:4408
-
C:\Users\Admin\AppData\Local\Temp\69D6.tmp"C:\Users\Admin\AppData\Local\Temp\69D6.tmp"106⤵PID:464
-
C:\Users\Admin\AppData\Local\Temp\6A24.tmp"C:\Users\Admin\AppData\Local\Temp\6A24.tmp"107⤵PID:4972
-
C:\Users\Admin\AppData\Local\Temp\6A72.tmp"C:\Users\Admin\AppData\Local\Temp\6A72.tmp"108⤵PID:5088
-
C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"C:\Users\Admin\AppData\Local\Temp\6AC0.tmp"109⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"C:\Users\Admin\AppData\Local\Temp\6B1E.tmp"110⤵PID:1428
-
C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"C:\Users\Admin\AppData\Local\Temp\6B6C.tmp"111⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"C:\Users\Admin\AppData\Local\Temp\6BBA.tmp"112⤵PID:1864
-
C:\Users\Admin\AppData\Local\Temp\6C08.tmp"C:\Users\Admin\AppData\Local\Temp\6C08.tmp"113⤵PID:4280
-
C:\Users\Admin\AppData\Local\Temp\6C56.tmp"C:\Users\Admin\AppData\Local\Temp\6C56.tmp"114⤵PID:2352
-
C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"C:\Users\Admin\AppData\Local\Temp\6CA4.tmp"115⤵PID:4100
-
C:\Users\Admin\AppData\Local\Temp\6D02.tmp"C:\Users\Admin\AppData\Local\Temp\6D02.tmp"116⤵PID:4860
-
C:\Users\Admin\AppData\Local\Temp\6D60.tmp"C:\Users\Admin\AppData\Local\Temp\6D60.tmp"117⤵PID:4864
-
C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"C:\Users\Admin\AppData\Local\Temp\6DAE.tmp"118⤵PID:5060
-
C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"C:\Users\Admin\AppData\Local\Temp\6E0C.tmp"119⤵PID:3704
-
C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"C:\Users\Admin\AppData\Local\Temp\6E5A.tmp"120⤵PID:1684
-
C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"C:\Users\Admin\AppData\Local\Temp\6EB8.tmp"121⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\6F06.tmp"C:\Users\Admin\AppData\Local\Temp\6F06.tmp"122⤵PID:3468
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-