79ad5dd9eaae0fde5b1a36b4c9b38ee7cfae82f51e196a1f6b1ff8b35b9cf463

Analysis

max time kernel
150s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Size

2.5MB
MD5

f5bcbb4c735c1e8bc4f68e534d8899da
SHA1

bbde97f7540370acd8925d5de239a3a4a42ea546
SHA256

79ad5dd9eaae0fde5b1a36b4c9b38ee7cfae82f51e196a1f6b1ff8b35b9cf463
SHA512

e19a75c2bcfe4f2e54323376195681e72568f013fce4e13b8861da54a918a9bd135869b7438d3ae3157f89ab5dce722caf3cb795772c398361e97d5e802b0be2
SSDEEP

1536:0KbLAsXjITFpfoOxRysNyyCOyXr5xWNTP/yIry9Ufu7Ps1+beJUrAc/DYhdUoYGe:v

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Windows security bypass 2 TTPs 4 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

Nirsoft 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000153cf-13.dat	Nirsoft

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

pid	Process
2216	AdvancedRun.exe
2552	AdvancedRun.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2232	AdvancedRun.exe
1840	AdvancedRun.exe
108	XmDwps.exe
1968	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2232	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1580	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1576	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1316	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
268	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1504	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2708	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2724	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2924	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2880	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2956	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2728	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2428	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2908	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1396	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1404	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1192	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
992	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2416	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
112	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2680	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2044	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2244	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1792	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2856	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2876	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
944	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2500	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1716	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1956	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
3052	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1240	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2892	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1544	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
636	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2700	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
3032	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2208	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2736	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2772	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2928	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2796	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2084	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2444	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2568	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
412	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2936	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2024	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2564	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1804	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2240	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2640	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2124	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2536	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1616	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
1172	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
616	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Loads dropped DLL 10 IoCs

pid	Process
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
2216	AdvancedRun.exe
2216	AdvancedRun.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2232	AdvancedRun.exe
2232	AdvancedRun.exe
788	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

Windows security modification 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8 = "C:\\Windows\\Microsoft.NET\\Framework\\x81d6417meYb4x3leNU451U4228ei732K\\svchost.exe"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8 = "C:\\Windows\\Microsoft.NET\\Framework\\x81d6417meYb4x3leNU451U4228ei732K\\svchost.exe"	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 21 IoCs

pid	Process
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1712 set thread context of 788	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	52

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
700	1712	WerFault.exe	27

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1172	timeout.exe
2644	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	AdvancedRun.exe
2216	AdvancedRun.exe
2552	AdvancedRun.exe
2552	AdvancedRun.exe
2536	powershell.exe
2756	powershell.exe
2456	powershell.exe
2124	powershell.exe
1600	powershell.exe
2796	powershell.exe
2416	powershell.exe
2500	powershell.exe
2232	AdvancedRun.exe
2232	AdvancedRun.exe
1840	AdvancedRun.exe
1840	AdvancedRun.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
1884	powershell.exe
1560	powershell.exe
1736	powershell.exe
2860	powershell.exe
1980	powershell.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	AdvancedRun.exe
Token: SeImpersonatePrivilege	2216	AdvancedRun.exe
Token: SeDebugPrivilege	2552	AdvancedRun.exe
Token: SeImpersonatePrivilege	2552	AdvancedRun.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeDebugPrivilege	2756	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2124	powershell.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	2796	powershell.exe
Token: SeDebugPrivilege	2416	powershell.exe
Token: SeDebugPrivilege	2500	powershell.exe
Token: SeDebugPrivilege	2232	AdvancedRun.exe
Token: SeImpersonatePrivilege	2232	AdvancedRun.exe
Token: SeDebugPrivilege	1840	AdvancedRun.exe
Token: SeImpersonatePrivilege	1840	AdvancedRun.exe
Token: SeDebugPrivilege	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Token: SeDebugPrivilege	108	XmDwps.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	1560	powershell.exe
Token: SeDebugPrivilege	1736	powershell.exe
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2216	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2216	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2216	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	28
PID 1712 wrote to memory of 2216	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	28
PID 2216 wrote to memory of 2552	2216	AdvancedRun.exe	29
PID 2216 wrote to memory of 2552	2216	AdvancedRun.exe	29
PID 2216 wrote to memory of 2552	2216	AdvancedRun.exe	29
PID 2216 wrote to memory of 2552	2216	AdvancedRun.exe	29
PID 1712 wrote to memory of 2796	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2796	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2796	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2796	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	30
PID 1712 wrote to memory of 2500	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2500	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2500	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2500	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	32
PID 1712 wrote to memory of 2536	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2536	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2536	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2536	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	34
PID 1712 wrote to memory of 2124	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2124	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2124	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2124	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	36
PID 1712 wrote to memory of 2416	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	87
PID 1712 wrote to memory of 2416	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	87
PID 1712 wrote to memory of 2416	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	87
PID 1712 wrote to memory of 2416	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	87
PID 1712 wrote to memory of 2476	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2476	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2476	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2476	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	40
PID 1712 wrote to memory of 2456	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2456	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2456	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	41
PID 1712 wrote to memory of 2456	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	41
PID 1712 wrote to memory of 1600	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1642
PID 1712 wrote to memory of 1600	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1642
PID 1712 wrote to memory of 1600	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1642
PID 1712 wrote to memory of 1600	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1642
PID 1712 wrote to memory of 2756	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1903
PID 1712 wrote to memory of 2756	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1903
PID 1712 wrote to memory of 2756	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1903
PID 1712 wrote to memory of 2756	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	1903
PID 2476 wrote to memory of 2232	2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	69
PID 2476 wrote to memory of 2232	2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	69
PID 2476 wrote to memory of 2232	2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	69
PID 2476 wrote to memory of 2232	2476	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe	69
PID 2232 wrote to memory of 1840	2232	AdvancedRun.exe	48
PID 2232 wrote to memory of 1840	2232	AdvancedRun.exe	48
PID 2232 wrote to memory of 1840	2232	AdvancedRun.exe	48
PID 2232 wrote to memory of 1840	2232	AdvancedRun.exe	48
PID 1712 wrote to memory of 2368	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	49
PID 1712 wrote to memory of 2368	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	49
PID 1712 wrote to memory of 2368	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	49
PID 1712 wrote to memory of 2368	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	49
PID 2368 wrote to memory of 1172	2368	cmd.exe	124
PID 2368 wrote to memory of 1172	2368	cmd.exe	124
PID 2368 wrote to memory of 1172	2368	cmd.exe	124
PID 2368 wrote to memory of 1172	2368	cmd.exe	124
PID 1712 wrote to memory of 788	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	52
PID 1712 wrote to memory of 788	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	52
PID 1712 wrote to memory of 788	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	52
PID 1712 wrote to memory of 788	1712	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe	52

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Windows security bypass
- Drops startup file
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1712
- C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\AdvancedRun.exe
  "C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\AdvancedRun.exe" /SpecialRun 4101d8 2216
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2500
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2536
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2124
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2416
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2476
- - C:\Users\Admin\AppData\Local\Temp\b5da3e98-78c6-4294-9bf3-c5e396525ed2\AdvancedRun.exe
    "C:\Users\Admin\AppData\Local\Temp\b5da3e98-78c6-4294-9bf3-c5e396525ed2\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\b5da3e98-78c6-4294-9bf3-c5e396525ed2\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\Users\Admin\AppData\Local\Temp\b5da3e98-78c6-4294-9bf3-c5e396525ed2\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\b5da3e98-78c6-4294-9bf3-c5e396525ed2\AdvancedRun.exe" /SpecialRun 4101d8 2232
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1840
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1560
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1736
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe" -Force
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1980
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c timeout 1
    3⤵
    PID:1744
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 1
      4⤵
      Delays execution with timeout.exe
      PID:2644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1968
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2232
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1192
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:992
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2416
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2680
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1792
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:3052
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1544
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:3032
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2736
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2772
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2640
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2124
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:2536
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:1172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    - Executes dropped EXE
    PID:616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1888
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1896
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1920
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:600
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2600
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2760
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1264
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1352
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2376
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:816
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1184
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:840
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1440
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2920
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3100
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3124
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3132
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3180
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3204
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3332
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3460
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3660
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3756
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3772
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3788
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3820
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3844
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3916
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3932
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:3996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4020
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4060
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4144
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4176
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4184
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4192
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4216
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4232
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4248
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4256
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4272
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4280
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4288
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4296
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4304
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4312
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4320
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4328
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4352
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4360
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4368
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4376
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4384
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4392
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4400
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4416
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4424
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4432
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4440
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4472
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4496
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4528
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4536
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4552
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4584
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4592
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4600
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4608
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4624
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4640
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4648
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4656
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4664
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4672
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4696
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4720
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4736
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4744
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4760
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4768
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4784
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4792
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4816
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4840
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4848
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4864
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4888
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4904
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4920
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4952
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4960
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4968
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4976
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:4992
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5008
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5016
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5024
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5032
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5040
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5072
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5080
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5088
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5096
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5184
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5216
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5240
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5248
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5272
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5288
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5304
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5328
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5336
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5376
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5536
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5544
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5552
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5568
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5584
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5592
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5608
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5624
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5664
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5672
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5688
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5696
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5704
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5712
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5728
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5760
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5776
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5784
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5800
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5808
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5816
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5824
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5832
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5840
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5848
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5856
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5864
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5872
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5880
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5888
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5896
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5904
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5912
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5920
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5928
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5936
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5944
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5952
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5960
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5976
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5984
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:5992
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6000
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6008
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6016
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6024
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6032
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6040
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6048
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6072
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6080
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6088
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6096
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6120
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6136
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6180
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6204
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6460
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6516
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6556
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6772
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6788
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6820
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6916
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6932
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:6996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7020
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7052
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7060
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7068
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2656
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7180
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7204
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7236
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7332
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7516
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7556
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7660
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7756
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7772
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7788
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7820
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7844
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7900
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7916
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7932
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:7996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8020
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8036
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8044
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8052
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8060
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8068
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8076
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8084
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8092
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8100
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8108
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8124
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8132
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8148
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8156
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8172
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8180
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8188
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8196
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8204
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8212
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8236
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8460
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8516
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8556
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8660
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8740
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8748
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8756
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8764
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8772
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8780
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8796
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8804
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8812
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8820
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8828
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8836
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8844
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8852
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8868
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8876
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8884
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8892
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8900
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8908
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8916
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8924
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8932
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8940
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8948
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8956
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8964
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8988
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:8996
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9004
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9012
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9020
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9032
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9040
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9048
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9056
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9064
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9072
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9080
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9088
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9096
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9104
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9112
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9120
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9128
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9144
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9152
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9160
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9168
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9176
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9184
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9192
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9200
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9208
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:1416
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9220
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9228
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9236
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9244
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9252
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9260
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9268
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9276
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9284
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9292
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9300
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9308
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9324
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9332
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9340
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9364
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9372
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9380
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9388
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9396
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9404
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9412
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9420
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9436
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9444
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9460
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9468
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9476
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9484
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9492
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9500
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9508
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9516
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9524
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9532
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9540
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9548
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9556
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9564
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9572
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9580
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9588
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9596
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9604
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9612
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9620
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9628
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9636
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9644
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9652
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9660
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9668
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9676
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9684
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9692
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9700
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9708
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9716
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9724
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9732
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe
    "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe"
    3⤵
    PID:9740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2456
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1600
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Windows\Microsoft.NET\Framework\x81d6417meYb4x3leNU451U4228ei732K\svchost.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - Delays execution with timeout.exe
    PID:1172
- C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f5bcbb4c735c1e8bc4f68e534d8899da_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  PID:788
- - C:\Users\Admin\AppData\Local\Temp\XmDwps.exe
    "C:\Users\Admin\AppData\Local\Temp\XmDwps.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1712 -s 936
  2⤵
  - Program crash
  PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\14840bca-0337-4ae7-9e79-1233e6953664\AdvancedRun.exe

Filesize
88KB

MD5
17fc12902f4769af3a9271eb4e2dacce

SHA1
9a4a1581cc3971579574f837e110f3bd6d529dab

SHA256
29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

SHA512
036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\XmDwps.exe

Filesize
5KB

MD5
692a863df959ffca30bd0752e1a90ae0

SHA1
39beb2ec5a3fb3ad914f83eafe91974a46d92ba8

SHA256
ca14e3ee993d2b06bc5ea5600d8f2ff3479e0319d56d04fe77ffcefbbc8dfd58

SHA512
9fa16c1e50b6a22c1affda2facdc0201a8248c03339f1b3de1f04093432c8c304ebd11ba05b0c7cd560eb7a6f755556e54e3288b879c3b012d4196659bb31e71

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\XQYDQ7LWW0SBWHTRQJBU.temp

Filesize
7KB

MD5
57635d9b9c707f701a41715c14f30cb4

SHA1
eddafddb57065e5b2137068062a1a19ca791c906

SHA256
ab37462285f6b9996d2656cad4f88b58afd4f9a0e8160cedb02ab98fe7ec5993

SHA512
54a40a184af52adc5a8a280b5cfcb4cc0b53d7943cb603a75e0ec71544a1fb05181e5c68a1e20add76c7c43a1bcf68ca53002c7f35496b524d0fd18f583bb774

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cado61c93j1b8i711d186da1Q2GWl814e77XfN5exT0c8.exe

Filesize
2.5MB

MD5
f5bcbb4c735c1e8bc4f68e534d8899da

SHA1
bbde97f7540370acd8925d5de239a3a4a42ea546

SHA256
79ad5dd9eaae0fde5b1a36b4c9b38ee7cfae82f51e196a1f6b1ff8b35b9cf463

SHA512
e19a75c2bcfe4f2e54323376195681e72568f013fce4e13b8861da54a918a9bd135869b7438d3ae3157f89ab5dce722caf3cb795772c398361e97d5e802b0be2

Download Submit
memory/108-133-0x00000000010F0000-0x00000000010F8000-memory.dmp

Filesize
32KB

Download
memory/108-135-0x000000001A690000-0x000000001A710000-memory.dmp

Filesize
512KB

Download
memory/108-134-0x000007FEF5970000-0x000007FEF635C000-memory.dmp

Filesize
9.9MB

Download
memory/788-126-0x0000000004370000-0x00000000043B0000-memory.dmp

Filesize
256KB

Download
memory/788-118-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-122-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-132-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/788-120-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-125-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/788-116-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/788-114-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-112-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-108-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/788-110-0x0000000000400000-0x000000000040A000-memory.dmp

Filesize
40KB

Download
memory/1560-155-0x0000000001D50000-0x0000000001D90000-memory.dmp

Filesize
256KB

Download
memory/1560-166-0x0000000001D50000-0x0000000001D90000-memory.dmp

Filesize
256KB

Download
memory/1560-167-0x0000000001D50000-0x0000000001D90000-memory.dmp

Filesize
256KB

Download
memory/1560-165-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/1600-92-0x0000000002E40000-0x0000000002E80000-memory.dmp

Filesize
256KB

Download
memory/1600-94-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/1600-90-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/1712-144-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/1712-2-0x0000000000380000-0x00000000003F2000-memory.dmp

Filesize
456KB

Download
memory/1712-3-0x00000000051F0000-0x0000000005230000-memory.dmp

Filesize
256KB

Download
memory/1712-0-0x0000000000A00000-0x0000000000C80000-memory.dmp

Filesize
2.5MB

Download
memory/1712-180-0x00000000051F0000-0x0000000005230000-memory.dmp

Filesize
256KB

Download
memory/1736-169-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/1736-168-0x0000000002DC0000-0x0000000002E00000-memory.dmp

Filesize
256KB

Download
memory/1736-171-0x0000000002DC0000-0x0000000002E00000-memory.dmp

Filesize
256KB

Download
memory/1736-170-0x0000000002DC0000-0x0000000002E00000-memory.dmp

Filesize
256KB

Download
memory/1884-154-0x00000000029E0000-0x0000000002A20000-memory.dmp

Filesize
256KB

Download
memory/1884-152-0x00000000029E0000-0x0000000002A20000-memory.dmp

Filesize
256KB

Download
memory/1884-151-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/1884-150-0x00000000029E0000-0x0000000002A20000-memory.dmp

Filesize
256KB

Download
memory/1884-149-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2124-89-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-96-0x0000000002C40000-0x0000000002C80000-memory.dmp

Filesize
256KB

Download
memory/2124-101-0x0000000002C40000-0x0000000002C80000-memory.dmp

Filesize
256KB

Download
memory/2124-87-0x0000000002C40000-0x0000000002C80000-memory.dmp

Filesize
256KB

Download
memory/2124-85-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-106-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-75-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-93-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2416-81-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2456-91-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2476-28-0x0000000074690000-0x0000000074D7E000-memory.dmp

Filesize
6.9MB

Download
memory/2476-27-0x0000000000370000-0x00000000005F0000-memory.dmp

Filesize
2.5MB

Download
memory/2476-104-0x0000000005140000-0x0000000005180000-memory.dmp

Filesize
256KB

Download
memory/2500-82-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2500-76-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2500-78-0x0000000002CC0000-0x0000000002D00000-memory.dmp

Filesize
256KB

Download
memory/2500-95-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-83-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-97-0x0000000002860000-0x00000000028A0000-memory.dmp

Filesize
256KB

Download
memory/2536-107-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-73-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2536-80-0x0000000002860000-0x00000000028A0000-memory.dmp

Filesize
256KB

Download
memory/2536-102-0x0000000002860000-0x00000000028A0000-memory.dmp

Filesize
256KB

Download
memory/2756-88-0x0000000002870000-0x00000000028B0000-memory.dmp

Filesize
256KB

Download
memory/2756-98-0x0000000002870000-0x00000000028B0000-memory.dmp

Filesize
256KB

Download
memory/2756-99-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2756-86-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2796-100-0x0000000002950000-0x0000000002990000-memory.dmp

Filesize
256KB

Download
memory/2796-84-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2796-103-0x0000000002950000-0x0000000002990000-memory.dmp

Filesize
256KB

Download
memory/2796-79-0x0000000002950000-0x0000000002990000-memory.dmp

Filesize
256KB

Download
memory/2796-77-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2796-105-0x000000006F460000-0x000000006FA0B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-173-0x000000006EC30000-0x000000006F1DB000-memory.dmp

Filesize
5.7MB

Download
memory/2860-175-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download
memory/2860-174-0x0000000002A40000-0x0000000002A80000-memory.dmp

Filesize
256KB

Download