4e0c304587581041658fc0cc72a53ae797839ae3b2acec8dd6df017dc0f68644

Analysis

max time kernel
126s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20240412-en
resource tags

arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
submitted
18/04/2024, 20:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

WindowsFormsApp4.exe
Size

20KB
MD5

f68c3c4cc9119f67a3741923b9c57825
SHA1

39e7aca6ab3f13aab9129b09792b9563d820613e
SHA256

4e0c304587581041658fc0cc72a53ae797839ae3b2acec8dd6df017dc0f68644
SHA512

4a128bb7f96c9649f9e27ec26e8c49f3dd292851e9368e3d3f8635516f09c27d07a9271a14d00fff0aa0b5ea40d462258a69085ab416a3eb796e444ddf314d26
SSDEEP

384:1GE0an/lY/WpSKi3L7Lc9DlOCLULILLE9nCSYVSbQ4mf9uwtptYcFwVc03K:s9aCepSKib/9+Y8mCSYobQ4euwftYcF9

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
2704	v3qhqbdtzod.exe
4344	qpgt5qil3kw.exe
2792	3et3ccml5sh.exe
4388	xpwqi4o4awd.exe
1212	jz3huptslv4.exe
4660	4cyx4n5bhzx.exe
3412	kuqg1itw43a.exe
4392	ouogwmmxntn.exe
2132	w0gfhwyj3hw.exe
3560	15wvgcvxhp0.exe
1132	j0adlig0bru.exe
2260	uydcpoesr4y.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 2704	5064	WindowsFormsApp4.exe	80
PID 5064 wrote to memory of 2704	5064	WindowsFormsApp4.exe	80
PID 5064 wrote to memory of 2704	5064	WindowsFormsApp4.exe	80
PID 5064 wrote to memory of 4344	5064	WindowsFormsApp4.exe	81
PID 5064 wrote to memory of 4344	5064	WindowsFormsApp4.exe	81
PID 5064 wrote to memory of 4344	5064	WindowsFormsApp4.exe	81
PID 5064 wrote to memory of 2792	5064	WindowsFormsApp4.exe	82
PID 5064 wrote to memory of 2792	5064	WindowsFormsApp4.exe	82
PID 5064 wrote to memory of 2792	5064	WindowsFormsApp4.exe	82
PID 5064 wrote to memory of 4388	5064	WindowsFormsApp4.exe	83
PID 5064 wrote to memory of 4388	5064	WindowsFormsApp4.exe	83
PID 5064 wrote to memory of 4388	5064	WindowsFormsApp4.exe	83
PID 5064 wrote to memory of 1212	5064	WindowsFormsApp4.exe	84
PID 5064 wrote to memory of 1212	5064	WindowsFormsApp4.exe	84
PID 5064 wrote to memory of 1212	5064	WindowsFormsApp4.exe	84
PID 5064 wrote to memory of 4660	5064	WindowsFormsApp4.exe	85
PID 5064 wrote to memory of 4660	5064	WindowsFormsApp4.exe	85
PID 5064 wrote to memory of 4660	5064	WindowsFormsApp4.exe	85
PID 5064 wrote to memory of 3412	5064	WindowsFormsApp4.exe	86
PID 5064 wrote to memory of 3412	5064	WindowsFormsApp4.exe	86
PID 5064 wrote to memory of 3412	5064	WindowsFormsApp4.exe	86
PID 5064 wrote to memory of 4392	5064	WindowsFormsApp4.exe	87
PID 5064 wrote to memory of 4392	5064	WindowsFormsApp4.exe	87
PID 5064 wrote to memory of 4392	5064	WindowsFormsApp4.exe	87
PID 5064 wrote to memory of 2132	5064	WindowsFormsApp4.exe	88
PID 5064 wrote to memory of 2132	5064	WindowsFormsApp4.exe	88
PID 5064 wrote to memory of 2132	5064	WindowsFormsApp4.exe	88
PID 5064 wrote to memory of 3560	5064	WindowsFormsApp4.exe	89
PID 5064 wrote to memory of 3560	5064	WindowsFormsApp4.exe	89
PID 5064 wrote to memory of 3560	5064	WindowsFormsApp4.exe	89
PID 5064 wrote to memory of 1132	5064	WindowsFormsApp4.exe	90
PID 5064 wrote to memory of 1132	5064	WindowsFormsApp4.exe	90
PID 5064 wrote to memory of 1132	5064	WindowsFormsApp4.exe	90
PID 5064 wrote to memory of 2260	5064	WindowsFormsApp4.exe	91
PID 5064 wrote to memory of 2260	5064	WindowsFormsApp4.exe	91
PID 5064 wrote to memory of 2260	5064	WindowsFormsApp4.exe	91
PID 5064 wrote to memory of 1612	5064	WindowsFormsApp4.exe	92
PID 5064 wrote to memory of 1612	5064	WindowsFormsApp4.exe	92
PID 5064 wrote to memory of 1612	5064	WindowsFormsApp4.exe	92
PID 5064 wrote to memory of 580	5064	WindowsFormsApp4.exe	93
PID 5064 wrote to memory of 580	5064	WindowsFormsApp4.exe	93
PID 5064 wrote to memory of 580	5064	WindowsFormsApp4.exe	93

C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe
"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\v3qhqbdtzod.exe
  "C:\Users\Admin\AppData\Local\Temp\v3qhqbdtzod.exe"
  2⤵
  - Executes dropped EXE
  PID:2704
- - C:\Users\Admin\AppData\Local\Temp\4tbnmctfmti.exe
    "C:\Users\Admin\AppData\Local\Temp\4tbnmctfmti.exe"
    3⤵
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\xgcdqisi0ba.exe
      "C:\Users\Admin\AppData\Local\Temp\xgcdqisi0ba.exe"
      4⤵
      PID:13576
  - - C:\Users\Admin\AppData\Local\Temp\mrfbhr0g024.exe
      "C:\Users\Admin\AppData\Local\Temp\mrfbhr0g024.exe"
      4⤵
      PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\0i4ln3z3b44.exe
      "C:\Users\Admin\AppData\Local\Temp\0i4ln3z3b44.exe"
      4⤵
      PID:25876
  - - C:\Users\Admin\AppData\Local\Temp\4qehh3jlp0a.exe
      "C:\Users\Admin\AppData\Local\Temp\4qehh3jlp0a.exe"
      4⤵
      PID:25588
  - - C:\Users\Admin\AppData\Local\Temp\npnl35gqffz.exe
      "C:\Users\Admin\AppData\Local\Temp\npnl35gqffz.exe"
      4⤵
      PID:32568
  - - C:\Users\Admin\AppData\Local\Temp\ri0mpgz30sy.exe
      "C:\Users\Admin\AppData\Local\Temp\ri0mpgz30sy.exe"
      4⤵
      PID:34384
- - C:\Users\Admin\AppData\Local\Temp\004awlsx2ms.exe
    "C:\Users\Admin\AppData\Local\Temp\004awlsx2ms.exe"
    3⤵
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\nn1k2uwej4q.exe
      "C:\Users\Admin\AppData\Local\Temp\nn1k2uwej4q.exe"
      4⤵
      PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\l0jo3vdxnh0.exe
      "C:\Users\Admin\AppData\Local\Temp\l0jo3vdxnh0.exe"
      4⤵
      PID:20148
  - - C:\Users\Admin\AppData\Local\Temp\ugfhoxqujyj.exe
      "C:\Users\Admin\AppData\Local\Temp\ugfhoxqujyj.exe"
      4⤵
      PID:22000
  - - C:\Users\Admin\AppData\Local\Temp\ot22w5solkt.exe
      "C:\Users\Admin\AppData\Local\Temp\ot22w5solkt.exe"
      4⤵
      PID:24276
  - - C:\Users\Admin\AppData\Local\Temp\wbigwo5rcxw.exe
      "C:\Users\Admin\AppData\Local\Temp\wbigwo5rcxw.exe"
      4⤵
      PID:24660
  - - C:\Users\Admin\AppData\Local\Temp\gocaczalj5j.exe
      "C:\Users\Admin\AppData\Local\Temp\gocaczalj5j.exe"
      4⤵
      PID:28496
- - C:\Users\Admin\AppData\Local\Temp\qx0233z3sxc.exe
    "C:\Users\Admin\AppData\Local\Temp\qx0233z3sxc.exe"
    3⤵
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\4fcol0grlcj.exe
      "C:\Users\Admin\AppData\Local\Temp\4fcol0grlcj.exe"
      4⤵
      PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\2umkt3bql01.exe
      "C:\Users\Admin\AppData\Local\Temp\2umkt3bql01.exe"
      4⤵
      PID:20780
  - - C:\Users\Admin\AppData\Local\Temp\vnxgvowpn44.exe
      "C:\Users\Admin\AppData\Local\Temp\vnxgvowpn44.exe"
      4⤵
      PID:23064
  - - C:\Users\Admin\AppData\Local\Temp\duca0bt32w2.exe
      "C:\Users\Admin\AppData\Local\Temp\duca0bt32w2.exe"
      4⤵
      PID:24248
  - - C:\Users\Admin\AppData\Local\Temp\xdvv3l1qfm3.exe
      "C:\Users\Admin\AppData\Local\Temp\xdvv3l1qfm3.exe"
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\ho1vghzkupo.exe
      "C:\Users\Admin\AppData\Local\Temp\ho1vghzkupo.exe"
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\is4jd3rrmgl.exe
      "C:\Users\Admin\AppData\Local\Temp\is4jd3rrmgl.exe"
      4⤵
      PID:2068
  - - C:\Users\Admin\AppData\Local\Temp\b22dai4txji.exe
      "C:\Users\Admin\AppData\Local\Temp\b22dai4txji.exe"
      4⤵
      PID:34728
- - C:\Users\Admin\AppData\Local\Temp\ufw44d4hdhk.exe
    "C:\Users\Admin\AppData\Local\Temp\ufw44d4hdhk.exe"
    3⤵
    PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\qhapulvwefp.exe
      "C:\Users\Admin\AppData\Local\Temp\qhapulvwefp.exe"
      4⤵
      PID:28452
  - - C:\Users\Admin\AppData\Local\Temp\ikjd0cjn2x2.exe
      "C:\Users\Admin\AppData\Local\Temp\ikjd0cjn2x2.exe"
      4⤵
      PID:27584
- - C:\Users\Admin\AppData\Local\Temp\nfrj23pcuje.exe
    "C:\Users\Admin\AppData\Local\Temp\nfrj23pcuje.exe"
    3⤵
    PID:912
  - - C:\Users\Admin\AppData\Local\Temp\mhjvmigqffo.exe
      "C:\Users\Admin\AppData\Local\Temp\mhjvmigqffo.exe"
      4⤵
      PID:20220
  - - C:\Users\Admin\AppData\Local\Temp\emgi5koprdi.exe
      "C:\Users\Admin\AppData\Local\Temp\emgi5koprdi.exe"
      4⤵
      PID:22044
  - - C:\Users\Admin\AppData\Local\Temp\mjgagzuruwb.exe
      "C:\Users\Admin\AppData\Local\Temp\mjgagzuruwb.exe"
      4⤵
      PID:26192
  - - C:\Users\Admin\AppData\Local\Temp\df3wrz42ucy.exe
      "C:\Users\Admin\AppData\Local\Temp\df3wrz42ucy.exe"
      4⤵
      PID:26460
- - C:\Users\Admin\AppData\Local\Temp\oagcawyaff0.exe
    "C:\Users\Admin\AppData\Local\Temp\oagcawyaff0.exe"
    3⤵
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\oxg2apwk0em.exe
      "C:\Users\Admin\AppData\Local\Temp\oxg2apwk0em.exe"
      4⤵
      PID:24384
  - - C:\Users\Admin\AppData\Local\Temp\wpe3cpyhpid.exe
      "C:\Users\Admin\AppData\Local\Temp\wpe3cpyhpid.exe"
      4⤵
      PID:31276
- - C:\Users\Admin\AppData\Local\Temp\aa4szaqoob3.exe
    "C:\Users\Admin\AppData\Local\Temp\aa4szaqoob3.exe"
    3⤵
    PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\smu5omymem1.exe
      "C:\Users\Admin\AppData\Local\Temp\smu5omymem1.exe"
      4⤵
      PID:32160
- - C:\Users\Admin\AppData\Local\Temp\0qhz1zyjaqk.exe
    "C:\Users\Admin\AppData\Local\Temp\0qhz1zyjaqk.exe"
    3⤵
    PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\gpavfjgcumf.exe
      "C:\Users\Admin\AppData\Local\Temp\gpavfjgcumf.exe"
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\32zumfbvwdc.exe
      "C:\Users\Admin\AppData\Local\Temp\32zumfbvwdc.exe"
      4⤵
      PID:24164
  - - C:\Users\Admin\AppData\Local\Temp\t2d5qrtdbvz.exe
      "C:\Users\Admin\AppData\Local\Temp\t2d5qrtdbvz.exe"
      4⤵
      PID:940
  - - C:\Users\Admin\AppData\Local\Temp\dyjwe0a45ip.exe
      "C:\Users\Admin\AppData\Local\Temp\dyjwe0a45ip.exe"
      4⤵
      PID:26472
- - C:\Users\Admin\AppData\Local\Temp\dootcypyhac.exe
    "C:\Users\Admin\AppData\Local\Temp\dootcypyhac.exe"
    3⤵
    PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\bpto5wesw2i.exe
      "C:\Users\Admin\AppData\Local\Temp\bpto5wesw2i.exe"
      4⤵
      PID:18368
  - - C:\Users\Admin\AppData\Local\Temp\qbklgza2m5o.exe
      "C:\Users\Admin\AppData\Local\Temp\qbklgza2m5o.exe"
      4⤵
      PID:20740
  - - C:\Users\Admin\AppData\Local\Temp\c5ylhymbjjx.exe
      "C:\Users\Admin\AppData\Local\Temp\c5ylhymbjjx.exe"
      4⤵
      PID:24312
  - - C:\Users\Admin\AppData\Local\Temp\0kgt0tj0cww.exe
      "C:\Users\Admin\AppData\Local\Temp\0kgt0tj0cww.exe"
      4⤵
      PID:28428
  - - C:\Users\Admin\AppData\Local\Temp\4j4kqzahzni.exe
      "C:\Users\Admin\AppData\Local\Temp\4j4kqzahzni.exe"
      4⤵
      PID:28972
- - C:\Users\Admin\AppData\Local\Temp\qzydn2hm4dh.exe
    "C:\Users\Admin\AppData\Local\Temp\qzydn2hm4dh.exe"
    3⤵
    PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\2ebrx0fz5yt.exe
      "C:\Users\Admin\AppData\Local\Temp\2ebrx0fz5yt.exe"
      4⤵
      PID:31528
- - C:\Users\Admin\AppData\Local\Temp\jxoyb4qrnpt.exe
    "C:\Users\Admin\AppData\Local\Temp\jxoyb4qrnpt.exe"
    3⤵
    PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\md1jpipr0pr.exe
      "C:\Users\Admin\AppData\Local\Temp\md1jpipr0pr.exe"
      4⤵
      PID:27980
  - - C:\Users\Admin\AppData\Local\Temp\yqsrgrlmddo.exe
      "C:\Users\Admin\AppData\Local\Temp\yqsrgrlmddo.exe"
      4⤵
      PID:32072
- - C:\Users\Admin\AppData\Local\Temp\3ehhinu1q40.exe
    "C:\Users\Admin\AppData\Local\Temp\3ehhinu1q40.exe"
    3⤵
    PID:10924
- - C:\Users\Admin\AppData\Local\Temp\lngp3vrhel1.exe
    "C:\Users\Admin\AppData\Local\Temp\lngp3vrhel1.exe"
    3⤵
    PID:13236
- - C:\Users\Admin\AppData\Local\Temp\0gl0mjtg4mh.exe
    "C:\Users\Admin\AppData\Local\Temp\0gl0mjtg4mh.exe"
    3⤵
    PID:16184
- - C:\Users\Admin\AppData\Local\Temp\cg0kobae4sv.exe
    "C:\Users\Admin\AppData\Local\Temp\cg0kobae4sv.exe"
    3⤵
    PID:21412
- - C:\Users\Admin\AppData\Local\Temp\od4hazdvou2.exe
    "C:\Users\Admin\AppData\Local\Temp\od4hazdvou2.exe"
    3⤵
    PID:22952
- - C:\Users\Admin\AppData\Local\Temp\5bsj1opozga.exe
    "C:\Users\Admin\AppData\Local\Temp\5bsj1opozga.exe"
    3⤵
    PID:4824
- - C:\Users\Admin\AppData\Local\Temp\iu3mamls3td.exe
    "C:\Users\Admin\AppData\Local\Temp\iu3mamls3td.exe"
    3⤵
    PID:28372
- - C:\Users\Admin\AppData\Local\Temp\a4qk4leqq2h.exe
    "C:\Users\Admin\AppData\Local\Temp\a4qk4leqq2h.exe"
    3⤵
    PID:28052
- - C:\Users\Admin\AppData\Local\Temp\smw0rtgurr5.exe
    "C:\Users\Admin\AppData\Local\Temp\smw0rtgurr5.exe"
    3⤵
    PID:28056
- - C:\Users\Admin\AppData\Local\Temp\prz40bgrqwz.exe
    "C:\Users\Admin\AppData\Local\Temp\prz40bgrqwz.exe"
    3⤵
    PID:34496
- C:\Users\Admin\AppData\Local\Temp\qpgt5qil3kw.exe
  "C:\Users\Admin\AppData\Local\Temp\qpgt5qil3kw.exe"
  2⤵
  - Executes dropped EXE
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\0yzstu0cbtr.exe
    "C:\Users\Admin\AppData\Local\Temp\0yzstu0cbtr.exe"
    3⤵
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\zpmricccr5v.exe
      "C:\Users\Admin\AppData\Local\Temp\zpmricccr5v.exe"
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\0q2pkqataxn.exe
      "C:\Users\Admin\AppData\Local\Temp\0q2pkqataxn.exe"
      4⤵
      PID:16312
  - - C:\Users\Admin\AppData\Local\Temp\yez3k1vnzhu.exe
      "C:\Users\Admin\AppData\Local\Temp\yez3k1vnzhu.exe"
      4⤵
      PID:25960
  - - C:\Users\Admin\AppData\Local\Temp\eju30bbiszz.exe
      "C:\Users\Admin\AppData\Local\Temp\eju30bbiszz.exe"
      4⤵
      PID:28400
  - - C:\Users\Admin\AppData\Local\Temp\gedruc4hsaa.exe
      "C:\Users\Admin\AppData\Local\Temp\gedruc4hsaa.exe"
      4⤵
      PID:32684
- - C:\Users\Admin\AppData\Local\Temp\zkifcwblqc1.exe
    "C:\Users\Admin\AppData\Local\Temp\zkifcwblqc1.exe"
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\hmis3emgcpg.exe
      "C:\Users\Admin\AppData\Local\Temp\hmis3emgcpg.exe"
      4⤵
      PID:20400
  - - C:\Users\Admin\AppData\Local\Temp\1ndkbxg4cxi.exe
      "C:\Users\Admin\AppData\Local\Temp\1ndkbxg4cxi.exe"
      4⤵
      PID:21020
  - - C:\Users\Admin\AppData\Local\Temp\vqhv345aldt.exe
      "C:\Users\Admin\AppData\Local\Temp\vqhv345aldt.exe"
      4⤵
      PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\33ryowindu5.exe
      "C:\Users\Admin\AppData\Local\Temp\33ryowindu5.exe"
      4⤵
      PID:29504
  - - C:\Users\Admin\AppData\Local\Temp\nxpslgywtnh.exe
      "C:\Users\Admin\AppData\Local\Temp\nxpslgywtnh.exe"
      4⤵
      PID:32524
- - C:\Users\Admin\AppData\Local\Temp\i4wp30xbofd.exe
    "C:\Users\Admin\AppData\Local\Temp\i4wp30xbofd.exe"
    3⤵
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\iet0gwogcyz.exe
      "C:\Users\Admin\AppData\Local\Temp\iet0gwogcyz.exe"
      4⤵
      PID:20428
  - - C:\Users\Admin\AppData\Local\Temp\d1jw25zoxld.exe
      "C:\Users\Admin\AppData\Local\Temp\d1jw25zoxld.exe"
      4⤵
      PID:22352
  - - C:\Users\Admin\AppData\Local\Temp\ciibxkr3t4i.exe
      "C:\Users\Admin\AppData\Local\Temp\ciibxkr3t4i.exe"
      4⤵
      PID:21016
  - - C:\Users\Admin\AppData\Local\Temp\vnzlafwvnl0.exe
      "C:\Users\Admin\AppData\Local\Temp\vnzlafwvnl0.exe"
      4⤵
      PID:20700
  - - C:\Users\Admin\AppData\Local\Temp\1v11khtfede.exe
      "C:\Users\Admin\AppData\Local\Temp\1v11khtfede.exe"
      4⤵
      PID:31204
- - C:\Users\Admin\AppData\Local\Temp\ygfo51fkg32.exe
    "C:\Users\Admin\AppData\Local\Temp\ygfo51fkg32.exe"
    3⤵
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\eiufmeowplh.exe
      "C:\Users\Admin\AppData\Local\Temp\eiufmeowplh.exe"
      4⤵
      PID:19224
  - - C:\Users\Admin\AppData\Local\Temp\5oyd3fqxem2.exe
      "C:\Users\Admin\AppData\Local\Temp\5oyd3fqxem2.exe"
      4⤵
      PID:20764
  - - C:\Users\Admin\AppData\Local\Temp\4dwrk55ua0p.exe
      "C:\Users\Admin\AppData\Local\Temp\4dwrk55ua0p.exe"
      4⤵
      PID:26200
  - - C:\Users\Admin\AppData\Local\Temp\3qg4uaq3m5q.exe
      "C:\Users\Admin\AppData\Local\Temp\3qg4uaq3m5q.exe"
      4⤵
      PID:26140
  - - C:\Users\Admin\AppData\Local\Temp\kzshh3suawf.exe
      "C:\Users\Admin\AppData\Local\Temp\kzshh3suawf.exe"
      4⤵
      PID:22260
  - - C:\Users\Admin\AppData\Local\Temp\xdx15dffh2o.exe
      "C:\Users\Admin\AppData\Local\Temp\xdx15dffh2o.exe"
      4⤵
      PID:32820
  - - C:\Users\Admin\AppData\Local\Temp\wnphh3vpprx.exe
      "C:\Users\Admin\AppData\Local\Temp\wnphh3vpprx.exe"
      4⤵
      PID:35636
- - C:\Users\Admin\AppData\Local\Temp\eacdoeourxg.exe
    "C:\Users\Admin\AppData\Local\Temp\eacdoeourxg.exe"
    3⤵
    PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\rpqcr30b1ep.exe
      "C:\Users\Admin\AppData\Local\Temp\rpqcr30b1ep.exe"
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\cpvass0dwlm.exe
      "C:\Users\Admin\AppData\Local\Temp\cpvass0dwlm.exe"
      4⤵
      PID:19984
  - - C:\Users\Admin\AppData\Local\Temp\pndixhajigi.exe
      "C:\Users\Admin\AppData\Local\Temp\pndixhajigi.exe"
      4⤵
      PID:32540
  - - C:\Users\Admin\AppData\Local\Temp\lpuh0agdtyj.exe
      "C:\Users\Admin\AppData\Local\Temp\lpuh0agdtyj.exe"
      4⤵
      PID:34504
- - C:\Users\Admin\AppData\Local\Temp\4t5nv043yqu.exe
    "C:\Users\Admin\AppData\Local\Temp\4t5nv043yqu.exe"
    3⤵
    PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\rn1yem33gvc.exe
      "C:\Users\Admin\AppData\Local\Temp\rn1yem33gvc.exe"
      4⤵
      PID:19320
  - - C:\Users\Admin\AppData\Local\Temp\u4et1cempzh.exe
      "C:\Users\Admin\AppData\Local\Temp\u4et1cempzh.exe"
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\bpvg2nf3svo.exe
      "C:\Users\Admin\AppData\Local\Temp\bpvg2nf3svo.exe"
      4⤵
      PID:19848
  - - C:\Users\Admin\AppData\Local\Temp\fgp3lst150t.exe
      "C:\Users\Admin\AppData\Local\Temp\fgp3lst150t.exe"
      4⤵
      PID:23804
  - - C:\Users\Admin\AppData\Local\Temp\boqbfhzxjs1.exe
      "C:\Users\Admin\AppData\Local\Temp\boqbfhzxjs1.exe"
      4⤵
      PID:27036
  - - C:\Users\Admin\AppData\Local\Temp\vcm4pfqkqjd.exe
      "C:\Users\Admin\AppData\Local\Temp\vcm4pfqkqjd.exe"
      4⤵
      PID:26616
  - - C:\Users\Admin\AppData\Local\Temp\vnpq44exs5r.exe
      "C:\Users\Admin\AppData\Local\Temp\vnpq44exs5r.exe"
      4⤵
      PID:24652
  - - C:\Users\Admin\AppData\Local\Temp\jxxjext0uxa.exe
      "C:\Users\Admin\AppData\Local\Temp\jxxjext0uxa.exe"
      4⤵
      PID:28540
- - C:\Users\Admin\AppData\Local\Temp\3kowttwclpd.exe
    "C:\Users\Admin\AppData\Local\Temp\3kowttwclpd.exe"
    3⤵
    PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\i5dcfph3ddj.exe
      "C:\Users\Admin\AppData\Local\Temp\i5dcfph3ddj.exe"
      4⤵
      PID:28524
  - - C:\Users\Admin\AppData\Local\Temp\yc24g2tyq5p.exe
      "C:\Users\Admin\AppData\Local\Temp\yc24g2tyq5p.exe"
      4⤵
      PID:26488
  - - C:\Users\Admin\AppData\Local\Temp\aluv4dfndll.exe
      "C:\Users\Admin\AppData\Local\Temp\aluv4dfndll.exe"
      4⤵
      PID:30932
- - C:\Users\Admin\AppData\Local\Temp\5yge33zpvua.exe
    "C:\Users\Admin\AppData\Local\Temp\5yge33zpvua.exe"
    3⤵
    PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\te2w10oihqw.exe
      "C:\Users\Admin\AppData\Local\Temp\te2w10oihqw.exe"
      4⤵
      PID:20436
  - - C:\Users\Admin\AppData\Local\Temp\52glxw02mgb.exe
      "C:\Users\Admin\AppData\Local\Temp\52glxw02mgb.exe"
      4⤵
      PID:20896
  - - C:\Users\Admin\AppData\Local\Temp\4muq32czefk.exe
      "C:\Users\Admin\AppData\Local\Temp\4muq32czefk.exe"
      4⤵
      PID:26168
  - - C:\Users\Admin\AppData\Local\Temp\izlk5ncrhs1.exe
      "C:\Users\Admin\AppData\Local\Temp\izlk5ncrhs1.exe"
      4⤵
      PID:26268
  - - C:\Users\Admin\AppData\Local\Temp\cibvukx24go.exe
      "C:\Users\Admin\AppData\Local\Temp\cibvukx24go.exe"
      4⤵
      PID:23640
  - - C:\Users\Admin\AppData\Local\Temp\rcwmxy30yep.exe
      "C:\Users\Admin\AppData\Local\Temp\rcwmxy30yep.exe"
      4⤵
      PID:35828
- - C:\Users\Admin\AppData\Local\Temp\ewv3zjzeift.exe
    "C:\Users\Admin\AppData\Local\Temp\ewv3zjzeift.exe"
    3⤵
    PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\kec42xflddz.exe
      "C:\Users\Admin\AppData\Local\Temp\kec42xflddz.exe"
      4⤵
      PID:32124
- - C:\Users\Admin\AppData\Local\Temp\k12khthzn2n.exe
    "C:\Users\Admin\AppData\Local\Temp\k12khthzn2n.exe"
    3⤵
    PID:10916
- - C:\Users\Admin\AppData\Local\Temp\2kn5fq0bqny.exe
    "C:\Users\Admin\AppData\Local\Temp\2kn5fq0bqny.exe"
    3⤵
    PID:13228
- - C:\Users\Admin\AppData\Local\Temp\aaddojgrqul.exe
    "C:\Users\Admin\AppData\Local\Temp\aaddojgrqul.exe"
    3⤵
    PID:16208
- - C:\Users\Admin\AppData\Local\Temp\5ofnlh35tfw.exe
    "C:\Users\Admin\AppData\Local\Temp\5ofnlh35tfw.exe"
    3⤵
    PID:14392
- - C:\Users\Admin\AppData\Local\Temp\e1bgwn5rk0g.exe
    "C:\Users\Admin\AppData\Local\Temp\e1bgwn5rk0g.exe"
    3⤵
    PID:16676
- - C:\Users\Admin\AppData\Local\Temp\2t0xkpzv3li.exe
    "C:\Users\Admin\AppData\Local\Temp\2t0xkpzv3li.exe"
    3⤵
    PID:22360
- - C:\Users\Admin\AppData\Local\Temp\jajpasgmkpr.exe
    "C:\Users\Admin\AppData\Local\Temp\jajpasgmkpr.exe"
    3⤵
    PID:23508
- - C:\Users\Admin\AppData\Local\Temp\3tz4mszq2hx.exe
    "C:\Users\Admin\AppData\Local\Temp\3tz4mszq2hx.exe"
    3⤵
    PID:26672
- - C:\Users\Admin\AppData\Local\Temp\tt5qbokwitz.exe
    "C:\Users\Admin\AppData\Local\Temp\tt5qbokwitz.exe"
    3⤵
    PID:29524
- - C:\Users\Admin\AppData\Local\Temp\q4ysckr0rvk.exe
    "C:\Users\Admin\AppData\Local\Temp\q4ysckr0rvk.exe"
    3⤵
    PID:31476
- C:\Users\Admin\AppData\Local\Temp\3et3ccml5sh.exe
  "C:\Users\Admin\AppData\Local\Temp\3et3ccml5sh.exe"
  2⤵
  - Executes dropped EXE
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\siqu1prxy0c.exe
    "C:\Users\Admin\AppData\Local\Temp\siqu1prxy0c.exe"
    3⤵
    PID:464
  - - C:\Users\Admin\AppData\Local\Temp\qxe0eiokstc.exe
      "C:\Users\Admin\AppData\Local\Temp\qxe0eiokstc.exe"
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\vpfdlzfawjc.exe
      "C:\Users\Admin\AppData\Local\Temp\vpfdlzfawjc.exe"
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\wrpkbpylgfs.exe
      "C:\Users\Admin\AppData\Local\Temp\wrpkbpylgfs.exe"
      4⤵
      PID:15916
  - - C:\Users\Admin\AppData\Local\Temp\ql145mq4agu.exe
      "C:\Users\Admin\AppData\Local\Temp\ql145mq4agu.exe"
      4⤵
      PID:19972
  - - C:\Users\Admin\AppData\Local\Temp\md2njhni05v.exe
      "C:\Users\Admin\AppData\Local\Temp\md2njhni05v.exe"
      4⤵
      PID:21804
  - - C:\Users\Admin\AppData\Local\Temp\k4hyprzks5p.exe
      "C:\Users\Admin\AppData\Local\Temp\k4hyprzks5p.exe"
      4⤵
      PID:20940
  - - C:\Users\Admin\AppData\Local\Temp\edsa5ssvsan.exe
      "C:\Users\Admin\AppData\Local\Temp\edsa5ssvsan.exe"
      4⤵
      PID:28208
  - - C:\Users\Admin\AppData\Local\Temp\vkisvenxpen.exe
      "C:\Users\Admin\AppData\Local\Temp\vkisvenxpen.exe"
      4⤵
      PID:22380
  - - C:\Users\Admin\AppData\Local\Temp\bgz5mqj3r0g.exe
      "C:\Users\Admin\AppData\Local\Temp\bgz5mqj3r0g.exe"
      4⤵
      PID:21744
- - C:\Users\Admin\AppData\Local\Temp\tynfcuk5oqb.exe
    "C:\Users\Admin\AppData\Local\Temp\tynfcuk5oqb.exe"
    3⤵
    PID:1856
  - - C:\Users\Admin\AppData\Local\Temp\4d1e0eadrl2.exe
      "C:\Users\Admin\AppData\Local\Temp\4d1e0eadrl2.exe"
      4⤵
      PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\z43o0ym4mq4.exe
      "C:\Users\Admin\AppData\Local\Temp\z43o0ym4mq4.exe"
      4⤵
      PID:25936
  - - C:\Users\Admin\AppData\Local\Temp\qnqkzlql3ue.exe
      "C:\Users\Admin\AppData\Local\Temp\qnqkzlql3ue.exe"
      4⤵
      PID:27496
  - - C:\Users\Admin\AppData\Local\Temp\i4ty5jwmcj5.exe
      "C:\Users\Admin\AppData\Local\Temp\i4ty5jwmcj5.exe"
      4⤵
      PID:15864
- - C:\Users\Admin\AppData\Local\Temp\qwuwnczrzj1.exe
    "C:\Users\Admin\AppData\Local\Temp\qwuwnczrzj1.exe"
    3⤵
    PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\0ivisawsx2z.exe
      "C:\Users\Admin\AppData\Local\Temp\0ivisawsx2z.exe"
      4⤵
      PID:19272
  - - C:\Users\Admin\AppData\Local\Temp\xwsklwcs3md.exe
      "C:\Users\Admin\AppData\Local\Temp\xwsklwcs3md.exe"
      4⤵
      PID:19348
  - - C:\Users\Admin\AppData\Local\Temp\xnz3ujgruv3.exe
      "C:\Users\Admin\AppData\Local\Temp\xnz3ujgruv3.exe"
      4⤵
      PID:24440
  - - C:\Users\Admin\AppData\Local\Temp\m4vnkkhubzh.exe
      "C:\Users\Admin\AppData\Local\Temp\m4vnkkhubzh.exe"
      4⤵
      PID:27692
  - - C:\Users\Admin\AppData\Local\Temp\xskburw5r4k.exe
      "C:\Users\Admin\AppData\Local\Temp\xskburw5r4k.exe"
      4⤵
      PID:27236
  - - C:\Users\Admin\AppData\Local\Temp\ydbxr2lgo2m.exe
      "C:\Users\Admin\AppData\Local\Temp\ydbxr2lgo2m.exe"
      4⤵
      PID:32548
- - C:\Users\Admin\AppData\Local\Temp\mulpk3vgif0.exe
    "C:\Users\Admin\AppData\Local\Temp\mulpk3vgif0.exe"
    3⤵
    PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\4ur314kcueo.exe
      "C:\Users\Admin\AppData\Local\Temp\4ur314kcueo.exe"
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\f3fujgitq11.exe
      "C:\Users\Admin\AppData\Local\Temp\f3fujgitq11.exe"
      4⤵
      PID:25884
  - - C:\Users\Admin\AppData\Local\Temp\jqtukivjdcr.exe
      "C:\Users\Admin\AppData\Local\Temp\jqtukivjdcr.exe"
      4⤵
      PID:26408
  - - C:\Users\Admin\AppData\Local\Temp\aiqumafhrlo.exe
      "C:\Users\Admin\AppData\Local\Temp\aiqumafhrlo.exe"
      4⤵
      PID:25236
  - - C:\Users\Admin\AppData\Local\Temp\ppqfsmgrbgi.exe
      "C:\Users\Admin\AppData\Local\Temp\ppqfsmgrbgi.exe"
      4⤵
      PID:32588
- - C:\Users\Admin\AppData\Local\Temp\dloqyahevsp.exe
    "C:\Users\Admin\AppData\Local\Temp\dloqyahevsp.exe"
    3⤵
    PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\tcesg12f5lh.exe
      "C:\Users\Admin\AppData\Local\Temp\tcesg12f5lh.exe"
      4⤵
      PID:408
  - - C:\Users\Admin\AppData\Local\Temp\mtwo1pbpyog.exe
      "C:\Users\Admin\AppData\Local\Temp\mtwo1pbpyog.exe"
      4⤵
      PID:31084
- - C:\Users\Admin\AppData\Local\Temp\flwbb4ivu0z.exe
    "C:\Users\Admin\AppData\Local\Temp\flwbb4ivu0z.exe"
    3⤵
    PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\fs1buyrd1cq.exe
      "C:\Users\Admin\AppData\Local\Temp\fs1buyrd1cq.exe"
      4⤵
      PID:19332
  - - C:\Users\Admin\AppData\Local\Temp\2gjxfisab0i.exe
      "C:\Users\Admin\AppData\Local\Temp\2gjxfisab0i.exe"
      4⤵
      PID:22512
  - - C:\Users\Admin\AppData\Local\Temp\b3jdit1mf5i.exe
      "C:\Users\Admin\AppData\Local\Temp\b3jdit1mf5i.exe"
      4⤵
      PID:21612
  - - C:\Users\Admin\AppData\Local\Temp\xrlh0vd4s23.exe
      "C:\Users\Admin\AppData\Local\Temp\xrlh0vd4s23.exe"
      4⤵
      PID:25612
  - - C:\Users\Admin\AppData\Local\Temp\q5vw5lbcnyf.exe
      "C:\Users\Admin\AppData\Local\Temp\q5vw5lbcnyf.exe"
      4⤵
      PID:27344
  - - C:\Users\Admin\AppData\Local\Temp\xoavy5tcccf.exe
      "C:\Users\Admin\AppData\Local\Temp\xoavy5tcccf.exe"
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\dddeqi3iq54.exe
      "C:\Users\Admin\AppData\Local\Temp\dddeqi3iq54.exe"
      4⤵
      PID:26740
- - C:\Users\Admin\AppData\Local\Temp\u43jee4gvpp.exe
    "C:\Users\Admin\AppData\Local\Temp\u43jee4gvpp.exe"
    3⤵
    PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\d33mb0kilwo.exe
      "C:\Users\Admin\AppData\Local\Temp\d33mb0kilwo.exe"
      4⤵
      PID:21876
  - - C:\Users\Admin\AppData\Local\Temp\qro3oexjgvc.exe
      "C:\Users\Admin\AppData\Local\Temp\qro3oexjgvc.exe"
      4⤵
      PID:25392
  - - C:\Users\Admin\AppData\Local\Temp\v1wwnbnlkpk.exe
      "C:\Users\Admin\AppData\Local\Temp\v1wwnbnlkpk.exe"
      4⤵
      PID:26980
- - C:\Users\Admin\AppData\Local\Temp\0erb0dinwqk.exe
    "C:\Users\Admin\AppData\Local\Temp\0erb0dinwqk.exe"
    3⤵
    PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\h1siabvhw5c.exe
      "C:\Users\Admin\AppData\Local\Temp\h1siabvhw5c.exe"
      4⤵
      PID:20496
  - - C:\Users\Admin\AppData\Local\Temp\borjuuc52je.exe
      "C:\Users\Admin\AppData\Local\Temp\borjuuc52je.exe"
      4⤵
      PID:29316
- - C:\Users\Admin\AppData\Local\Temp\abhq4twmi3b.exe
    "C:\Users\Admin\AppData\Local\Temp\abhq4twmi3b.exe"
    3⤵
    PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\mondp0vs5de.exe
      "C:\Users\Admin\AppData\Local\Temp\mondp0vs5de.exe"
      4⤵
      PID:5504
- - C:\Users\Admin\AppData\Local\Temp\hespoeiinhz.exe
    "C:\Users\Admin\AppData\Local\Temp\hespoeiinhz.exe"
    3⤵
    PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\ezkfvnmroju.exe
      "C:\Users\Admin\AppData\Local\Temp\ezkfvnmroju.exe"
      4⤵
      PID:7744
- - C:\Users\Admin\AppData\Local\Temp\zh5fgoppbqe.exe
    "C:\Users\Admin\AppData\Local\Temp\zh5fgoppbqe.exe"
    3⤵
    PID:11176
- - C:\Users\Admin\AppData\Local\Temp\rkwef4bky5u.exe
    "C:\Users\Admin\AppData\Local\Temp\rkwef4bky5u.exe"
    3⤵
    PID:13696
- - C:\Users\Admin\AppData\Local\Temp\othwak3wmqg.exe
    "C:\Users\Admin\AppData\Local\Temp\othwak3wmqg.exe"
    3⤵
    PID:15108
- - C:\Users\Admin\AppData\Local\Temp\dyelq0kp5td.exe
    "C:\Users\Admin\AppData\Local\Temp\dyelq0kp5td.exe"
    3⤵
    PID:25084
- - C:\Users\Admin\AppData\Local\Temp\vy13uyox5bd.exe
    "C:\Users\Admin\AppData\Local\Temp\vy13uyox5bd.exe"
    3⤵
    PID:26812
- - C:\Users\Admin\AppData\Local\Temp\qwirfwthgnj.exe
    "C:\Users\Admin\AppData\Local\Temp\qwirfwthgnj.exe"
    3⤵
    PID:27492
- - C:\Users\Admin\AppData\Local\Temp\5nk2uzp3jqr.exe
    "C:\Users\Admin\AppData\Local\Temp\5nk2uzp3jqr.exe"
    3⤵
    PID:28316
- - C:\Users\Admin\AppData\Local\Temp\5b3yrlmkvuu.exe
    "C:\Users\Admin\AppData\Local\Temp\5b3yrlmkvuu.exe"
    3⤵
    PID:32184
- C:\Users\Admin\AppData\Local\Temp\xpwqi4o4awd.exe
  "C:\Users\Admin\AppData\Local\Temp\xpwqi4o4awd.exe"
  2⤵
  - Executes dropped EXE
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\d223dj2pokt.exe
    "C:\Users\Admin\AppData\Local\Temp\d223dj2pokt.exe"
    3⤵
    PID:11044
- - C:\Users\Admin\AppData\Local\Temp\l15pqrim03g.exe
    "C:\Users\Admin\AppData\Local\Temp\l15pqrim03g.exe"
    3⤵
    PID:13824
- - C:\Users\Admin\AppData\Local\Temp\2nmhaffv141.exe
    "C:\Users\Admin\AppData\Local\Temp\2nmhaffv141.exe"
    3⤵
    PID:14756
- - C:\Users\Admin\AppData\Local\Temp\f2punb1xspu.exe
    "C:\Users\Admin\AppData\Local\Temp\f2punb1xspu.exe"
    3⤵
    PID:18132
- - C:\Users\Admin\AppData\Local\Temp\w2imtlsnsa4.exe
    "C:\Users\Admin\AppData\Local\Temp\w2imtlsnsa4.exe"
    3⤵
    PID:19760
- - C:\Users\Admin\AppData\Local\Temp\5k2zze3x1mq.exe
    "C:\Users\Admin\AppData\Local\Temp\5k2zze3x1mq.exe"
    3⤵
    PID:24012
- - C:\Users\Admin\AppData\Local\Temp\oen2wh4py0n.exe
    "C:\Users\Admin\AppData\Local\Temp\oen2wh4py0n.exe"
    3⤵
    PID:20864
- - C:\Users\Admin\AppData\Local\Temp\vhy1ndnerx4.exe
    "C:\Users\Admin\AppData\Local\Temp\vhy1ndnerx4.exe"
    3⤵
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\zhucz240gqc.exe
    "C:\Users\Admin\AppData\Local\Temp\zhucz240gqc.exe"
    3⤵
    PID:32028
- C:\Users\Admin\AppData\Local\Temp\jz3huptslv4.exe
  "C:\Users\Admin\AppData\Local\Temp\jz3huptslv4.exe"
  2⤵
  - Executes dropped EXE
  PID:1212
- - C:\Users\Admin\AppData\Local\Temp\erlt5vyzftb.exe
    "C:\Users\Admin\AppData\Local\Temp\erlt5vyzftb.exe"
    3⤵
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\ktvryqd24c0.exe
      "C:\Users\Admin\AppData\Local\Temp\ktvryqd24c0.exe"
      4⤵
      PID:19144
  - - C:\Users\Admin\AppData\Local\Temp\r41yatcjb5b.exe
      "C:\Users\Admin\AppData\Local\Temp\r41yatcjb5b.exe"
      4⤵
      PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\inq2zdf54pv.exe
      "C:\Users\Admin\AppData\Local\Temp\inq2zdf54pv.exe"
      4⤵
      PID:24428
  - - C:\Users\Admin\AppData\Local\Temp\cbzaalh1jie.exe
      "C:\Users\Admin\AppData\Local\Temp\cbzaalh1jie.exe"
      4⤵
      PID:20492
  - - C:\Users\Admin\AppData\Local\Temp\tuvx5lurkdl.exe
      "C:\Users\Admin\AppData\Local\Temp\tuvx5lurkdl.exe"
      4⤵
      PID:24756
- - C:\Users\Admin\AppData\Local\Temp\meyh43l5dka.exe
    "C:\Users\Admin\AppData\Local\Temp\meyh43l5dka.exe"
    3⤵
    PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\1klzot5rnam.exe
      "C:\Users\Admin\AppData\Local\Temp\1klzot5rnam.exe"
      4⤵
      PID:18356
  - - C:\Users\Admin\AppData\Local\Temp\wmz4ioqy0gn.exe
      "C:\Users\Admin\AppData\Local\Temp\wmz4ioqy0gn.exe"
      4⤵
      PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\4zknxjgvpdn.exe
      "C:\Users\Admin\AppData\Local\Temp\4zknxjgvpdn.exe"
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\0410aumj0pf.exe
      "C:\Users\Admin\AppData\Local\Temp\0410aumj0pf.exe"
      4⤵
      PID:26336
  - - C:\Users\Admin\AppData\Local\Temp\q4wxtpqn1ak.exe
      "C:\Users\Admin\AppData\Local\Temp\q4wxtpqn1ak.exe"
      4⤵
      PID:20540
  - - C:\Users\Admin\AppData\Local\Temp\ker5oxrc5kf.exe
      "C:\Users\Admin\AppData\Local\Temp\ker5oxrc5kf.exe"
      4⤵
      PID:32720
- - C:\Users\Admin\AppData\Local\Temp\0jcpxyqutcm.exe
    "C:\Users\Admin\AppData\Local\Temp\0jcpxyqutcm.exe"
    3⤵
    PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\vz0s0ec2vyt.exe
      "C:\Users\Admin\AppData\Local\Temp\vz0s0ec2vyt.exe"
      4⤵
      PID:19120
  - - C:\Users\Admin\AppData\Local\Temp\s43hmssg3e1.exe
      "C:\Users\Admin\AppData\Local\Temp\s43hmssg3e1.exe"
      4⤵
      PID:24796
  - - C:\Users\Admin\AppData\Local\Temp\jearphbmpst.exe
      "C:\Users\Admin\AppData\Local\Temp\jearphbmpst.exe"
      4⤵
      PID:20560
  - - C:\Users\Admin\AppData\Local\Temp\fs4fdqdsazu.exe
      "C:\Users\Admin\AppData\Local\Temp\fs4fdqdsazu.exe"
      4⤵
      PID:29452
  - - C:\Users\Admin\AppData\Local\Temp\fif44rsipxl.exe
      "C:\Users\Admin\AppData\Local\Temp\fif44rsipxl.exe"
      4⤵
      PID:32644
- - C:\Users\Admin\AppData\Local\Temp\ql1lvudykr0.exe
    "C:\Users\Admin\AppData\Local\Temp\ql1lvudykr0.exe"
    3⤵
    PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\fqwxr5doxgd.exe
      "C:\Users\Admin\AppData\Local\Temp\fqwxr5doxgd.exe"
      4⤵
      PID:19428
  - - C:\Users\Admin\AppData\Local\Temp\iyv34ndxdhp.exe
      "C:\Users\Admin\AppData\Local\Temp\iyv34ndxdhp.exe"
      4⤵
      PID:17452
  - - C:\Users\Admin\AppData\Local\Temp\dkr3jxr5ijl.exe
      "C:\Users\Admin\AppData\Local\Temp\dkr3jxr5ijl.exe"
      4⤵
      PID:22328
  - - C:\Users\Admin\AppData\Local\Temp\bbpusnmksvy.exe
      "C:\Users\Admin\AppData\Local\Temp\bbpusnmksvy.exe"
      4⤵
      PID:26480
  - - C:\Users\Admin\AppData\Local\Temp\ex4ppuaacqs.exe
      "C:\Users\Admin\AppData\Local\Temp\ex4ppuaacqs.exe"
      4⤵
      PID:28100
  - - C:\Users\Admin\AppData\Local\Temp\4wfhhos3k5p.exe
      "C:\Users\Admin\AppData\Local\Temp\4wfhhos3k5p.exe"
      4⤵
      PID:27096
  - - C:\Users\Admin\AppData\Local\Temp\304ukg1h2tk.exe
      "C:\Users\Admin\AppData\Local\Temp\304ukg1h2tk.exe"
      4⤵
      PID:29956
  - - C:\Users\Admin\AppData\Local\Temp\zedvre3tccd.exe
      "C:\Users\Admin\AppData\Local\Temp\zedvre3tccd.exe"
      4⤵
      PID:17272
- - C:\Users\Admin\AppData\Local\Temp\4f5xvum4gg0.exe
    "C:\Users\Admin\AppData\Local\Temp\4f5xvum4gg0.exe"
    3⤵
    PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\u5gnqwpoagd.exe
      "C:\Users\Admin\AppData\Local\Temp\u5gnqwpoagd.exe"
      4⤵
      PID:15116
  - - C:\Users\Admin\AppData\Local\Temp\532i22d4cdm.exe
      "C:\Users\Admin\AppData\Local\Temp\532i22d4cdm.exe"
      4⤵
      PID:18864
  - - C:\Users\Admin\AppData\Local\Temp\ev4repnnhlz.exe
      "C:\Users\Admin\AppData\Local\Temp\ev4repnnhlz.exe"
      4⤵
      PID:20528
  - - C:\Users\Admin\AppData\Local\Temp\xd0waqkkyga.exe
      "C:\Users\Admin\AppData\Local\Temp\xd0waqkkyga.exe"
      4⤵
      PID:23516
  - - C:\Users\Admin\AppData\Local\Temp\a4zc2uw0ag5.exe
      "C:\Users\Admin\AppData\Local\Temp\a4zc2uw0ag5.exe"
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\4ygsnvqj1aa.exe
      "C:\Users\Admin\AppData\Local\Temp\4ygsnvqj1aa.exe"
      4⤵
      PID:28676
  - - C:\Users\Admin\AppData\Local\Temp\z3jpa0qu2ws.exe
      "C:\Users\Admin\AppData\Local\Temp\z3jpa0qu2ws.exe"
      4⤵
      PID:28748
- - C:\Users\Admin\AppData\Local\Temp\d2bm1nm1pj3.exe
    "C:\Users\Admin\AppData\Local\Temp\d2bm1nm1pj3.exe"
    3⤵
    PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\akcvocxmf4o.exe
      "C:\Users\Admin\AppData\Local\Temp\akcvocxmf4o.exe"
      4⤵
      PID:26208
  - - C:\Users\Admin\AppData\Local\Temp\wxr0s34zzyi.exe
      "C:\Users\Admin\AppData\Local\Temp\wxr0s34zzyi.exe"
      4⤵
      PID:25216
  - - C:\Users\Admin\AppData\Local\Temp\s3g5cusyiui.exe
      "C:\Users\Admin\AppData\Local\Temp\s3g5cusyiui.exe"
      4⤵
      PID:32432
- - C:\Users\Admin\AppData\Local\Temp\pmmfa5x5gvn.exe
    "C:\Users\Admin\AppData\Local\Temp\pmmfa5x5gvn.exe"
    3⤵
    PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\zhficglrwic.exe
      "C:\Users\Admin\AppData\Local\Temp\zhficglrwic.exe"
      4⤵
      PID:29840
  - - C:\Users\Admin\AppData\Local\Temp\slqpv2ev0tn.exe
      "C:\Users\Admin\AppData\Local\Temp\slqpv2ev0tn.exe"
      4⤵
      PID:34808
- - C:\Users\Admin\AppData\Local\Temp\1pbbi0brwjv.exe
    "C:\Users\Admin\AppData\Local\Temp\1pbbi0brwjv.exe"
    3⤵
    PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\xf0qxzw0dp0.exe
      "C:\Users\Admin\AppData\Local\Temp\xf0qxzw0dp0.exe"
      4⤵
      PID:35296
- - C:\Users\Admin\AppData\Local\Temp\x1aqzkdpxzw.exe
    "C:\Users\Admin\AppData\Local\Temp\x1aqzkdpxzw.exe"
    3⤵
    PID:11280
- - C:\Users\Admin\AppData\Local\Temp\rbh14z5oquh.exe
    "C:\Users\Admin\AppData\Local\Temp\rbh14z5oquh.exe"
    3⤵
    PID:15096
- - C:\Users\Admin\AppData\Local\Temp\zegjose4btc.exe
    "C:\Users\Admin\AppData\Local\Temp\zegjose4btc.exe"
    3⤵
    PID:14604
- - C:\Users\Admin\AppData\Local\Temp\mm2gitx5qpw.exe
    "C:\Users\Admin\AppData\Local\Temp\mm2gitx5qpw.exe"
    3⤵
    PID:19820
- - C:\Users\Admin\AppData\Local\Temp\o1yv0fb2vno.exe
    "C:\Users\Admin\AppData\Local\Temp\o1yv0fb2vno.exe"
    3⤵
    PID:23536
- - C:\Users\Admin\AppData\Local\Temp\upqx14nyetw.exe
    "C:\Users\Admin\AppData\Local\Temp\upqx14nyetw.exe"
    3⤵
    PID:8968
- - C:\Users\Admin\AppData\Local\Temp\rr0ot2ztwxz.exe
    "C:\Users\Admin\AppData\Local\Temp\rr0ot2ztwxz.exe"
    3⤵
    PID:28028
- - C:\Users\Admin\AppData\Local\Temp\dcbi25rof0k.exe
    "C:\Users\Admin\AppData\Local\Temp\dcbi25rof0k.exe"
    3⤵
    PID:20264
- C:\Users\Admin\AppData\Local\Temp\4cyx4n5bhzx.exe
  "C:\Users\Admin\AppData\Local\Temp\4cyx4n5bhzx.exe"
  2⤵
  - Executes dropped EXE
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\q51lelrkl4g.exe
    "C:\Users\Admin\AppData\Local\Temp\q51lelrkl4g.exe"
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\rfgca0oyy0s.exe
      "C:\Users\Admin\AppData\Local\Temp\rfgca0oyy0s.exe"
      4⤵
      PID:19620
  - - C:\Users\Admin\AppData\Local\Temp\bv2vej2qfap.exe
      "C:\Users\Admin\AppData\Local\Temp\bv2vej2qfap.exe"
      4⤵
      PID:20772
  - - C:\Users\Admin\AppData\Local\Temp\iq3mt5thjlz.exe
      "C:\Users\Admin\AppData\Local\Temp\iq3mt5thjlz.exe"
      4⤵
      PID:23304
  - - C:\Users\Admin\AppData\Local\Temp\rzqy4w4wnvk.exe
      "C:\Users\Admin\AppData\Local\Temp\rzqy4w4wnvk.exe"
      4⤵
      PID:28444
  - - C:\Users\Admin\AppData\Local\Temp\wy05woz5pc5.exe
      "C:\Users\Admin\AppData\Local\Temp\wy05woz5pc5.exe"
      4⤵
      PID:23068
- - C:\Users\Admin\AppData\Local\Temp\bu42osryqzj.exe
    "C:\Users\Admin\AppData\Local\Temp\bu42osryqzj.exe"
    3⤵
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\xgvdhcjmo1i.exe
      "C:\Users\Admin\AppData\Local\Temp\xgvdhcjmo1i.exe"
      4⤵
      PID:20804
  - - C:\Users\Admin\AppData\Local\Temp\z0n1fivojzi.exe
      "C:\Users\Admin\AppData\Local\Temp\z0n1fivojzi.exe"
      4⤵
      PID:19996
  - - C:\Users\Admin\AppData\Local\Temp\3xiikb20q3f.exe
      "C:\Users\Admin\AppData\Local\Temp\3xiikb20q3f.exe"
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\isykmyvm5l4.exe
      "C:\Users\Admin\AppData\Local\Temp\isykmyvm5l4.exe"
      4⤵
      PID:26852
  - - C:\Users\Admin\AppData\Local\Temp\0gealdsjqhj.exe
      "C:\Users\Admin\AppData\Local\Temp\0gealdsjqhj.exe"
      4⤵
      PID:27268
  - - C:\Users\Admin\AppData\Local\Temp\fuqfezh5feb.exe
      "C:\Users\Admin\AppData\Local\Temp\fuqfezh5feb.exe"
      4⤵
      PID:6168
- - C:\Users\Admin\AppData\Local\Temp\shtohjrtwbq.exe
    "C:\Users\Admin\AppData\Local\Temp\shtohjrtwbq.exe"
    3⤵
    PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\wao1skbeehb.exe
      "C:\Users\Admin\AppData\Local\Temp\wao1skbeehb.exe"
      4⤵
      PID:17824
  - - C:\Users\Admin\AppData\Local\Temp\dtnsvqs1hjp.exe
      "C:\Users\Admin\AppData\Local\Temp\dtnsvqs1hjp.exe"
      4⤵
      PID:23312
  - - C:\Users\Admin\AppData\Local\Temp\0iyehamx2o3.exe
      "C:\Users\Admin\AppData\Local\Temp\0iyehamx2o3.exe"
      4⤵
      PID:26284
  - - C:\Users\Admin\AppData\Local\Temp\q53eu3wu34d.exe
      "C:\Users\Admin\AppData\Local\Temp\q53eu3wu34d.exe"
      4⤵
      PID:26224
  - - C:\Users\Admin\AppData\Local\Temp\vut3zpp0yhd.exe
      "C:\Users\Admin\AppData\Local\Temp\vut3zpp0yhd.exe"
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\bu2yicartab.exe
      "C:\Users\Admin\AppData\Local\Temp\bu2yicartab.exe"
      4⤵
      PID:32492
- - C:\Users\Admin\AppData\Local\Temp\cu1tcw3lewh.exe
    "C:\Users\Admin\AppData\Local\Temp\cu1tcw3lewh.exe"
    3⤵
    PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\mdyuhfy3w12.exe
      "C:\Users\Admin\AppData\Local\Temp\mdyuhfy3w12.exe"
      4⤵
      PID:18944
  - - C:\Users\Admin\AppData\Local\Temp\zecdbtqez4d.exe
      "C:\Users\Admin\AppData\Local\Temp\zecdbtqez4d.exe"
      4⤵
      PID:18188
  - - C:\Users\Admin\AppData\Local\Temp\3xp0thwc4at.exe
      "C:\Users\Admin\AppData\Local\Temp\3xp0thwc4at.exe"
      4⤵
      PID:24540
  - - C:\Users\Admin\AppData\Local\Temp\0rcljpujwr5.exe
      "C:\Users\Admin\AppData\Local\Temp\0rcljpujwr5.exe"
      4⤵
      PID:22128
  - - C:\Users\Admin\AppData\Local\Temp\euwrojpljmj.exe
      "C:\Users\Admin\AppData\Local\Temp\euwrojpljmj.exe"
      4⤵
      PID:27732
- - C:\Users\Admin\AppData\Local\Temp\cxcal0fegja.exe
    "C:\Users\Admin\AppData\Local\Temp\cxcal0fegja.exe"
    3⤵
    PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\t2pik2biuru.exe
      "C:\Users\Admin\AppData\Local\Temp\t2pik2biuru.exe"
      4⤵
      PID:18988
  - - C:\Users\Admin\AppData\Local\Temp\y4rkt0kdr2i.exe
      "C:\Users\Admin\AppData\Local\Temp\y4rkt0kdr2i.exe"
      4⤵
      PID:19640
  - - C:\Users\Admin\AppData\Local\Temp\qsy0amsm2pw.exe
      "C:\Users\Admin\AppData\Local\Temp\qsy0amsm2pw.exe"
      4⤵
      PID:24216
  - - C:\Users\Admin\AppData\Local\Temp\vjo2bvk2nwy.exe
      "C:\Users\Admin\AppData\Local\Temp\vjo2bvk2nwy.exe"
      4⤵
      PID:29348
  - - C:\Users\Admin\AppData\Local\Temp\fzybxwzw4ro.exe
      "C:\Users\Admin\AppData\Local\Temp\fzybxwzw4ro.exe"
      4⤵
      PID:31268
- - C:\Users\Admin\AppData\Local\Temp\sl3lavbjzmy.exe
    "C:\Users\Admin\AppData\Local\Temp\sl3lavbjzmy.exe"
    3⤵
    PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\p1r0nodoba0.exe
      "C:\Users\Admin\AppData\Local\Temp\p1r0nodoba0.exe"
      4⤵
      PID:19216
  - - C:\Users\Admin\AppData\Local\Temp\hckjih1ffmn.exe
      "C:\Users\Admin\AppData\Local\Temp\hckjih1ffmn.exe"
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\i1hcn10vjxe.exe
      "C:\Users\Admin\AppData\Local\Temp\i1hcn10vjxe.exe"
      4⤵
      PID:24284
  - - C:\Users\Admin\AppData\Local\Temp\4hm2a5pez3j.exe
      "C:\Users\Admin\AppData\Local\Temp\4hm2a5pez3j.exe"
      4⤵
      PID:26212
  - - C:\Users\Admin\AppData\Local\Temp\tbbc022szhe.exe
      "C:\Users\Admin\AppData\Local\Temp\tbbc022szhe.exe"
      4⤵
      PID:24480
  - - C:\Users\Admin\AppData\Local\Temp\whgpb03futt.exe
      "C:\Users\Admin\AppData\Local\Temp\whgpb03futt.exe"
      4⤵
      PID:31072
- - C:\Users\Admin\AppData\Local\Temp\w4bkyquje3p.exe
    "C:\Users\Admin\AppData\Local\Temp\w4bkyquje3p.exe"
    3⤵
    PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\xaak2lx2i5y.exe
      "C:\Users\Admin\AppData\Local\Temp\xaak2lx2i5y.exe"
      4⤵
      PID:12592
- - C:\Users\Admin\AppData\Local\Temp\evtxf5sratm.exe
    "C:\Users\Admin\AppData\Local\Temp\evtxf5sratm.exe"
    3⤵
    PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\e334biexmnp.exe
      "C:\Users\Admin\AppData\Local\Temp\e334biexmnp.exe"
      4⤵
      PID:34780
- - C:\Users\Admin\AppData\Local\Temp\jcbkvl4budm.exe
    "C:\Users\Admin\AppData\Local\Temp\jcbkvl4budm.exe"
    3⤵
    PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\eaipktlfe3g.exe
      "C:\Users\Admin\AppData\Local\Temp\eaipktlfe3g.exe"
      4⤵
      PID:17740
- - C:\Users\Admin\AppData\Local\Temp\k5dr0yd0ogb.exe
    "C:\Users\Admin\AppData\Local\Temp\k5dr0yd0ogb.exe"
    3⤵
    PID:12520
- - C:\Users\Admin\AppData\Local\Temp\mnrcr1qafip.exe
    "C:\Users\Admin\AppData\Local\Temp\mnrcr1qafip.exe"
    3⤵
    PID:16340
- - C:\Users\Admin\AppData\Local\Temp\ekdeypi0q4x.exe
    "C:\Users\Admin\AppData\Local\Temp\ekdeypi0q4x.exe"
    3⤵
    PID:20276
- - C:\Users\Admin\AppData\Local\Temp\crjmozmor4a.exe
    "C:\Users\Admin\AppData\Local\Temp\crjmozmor4a.exe"
    3⤵
    PID:23888
- - C:\Users\Admin\AppData\Local\Temp\1xhih4fqx11.exe
    "C:\Users\Admin\AppData\Local\Temp\1xhih4fqx11.exe"
    3⤵
    PID:28184
- - C:\Users\Admin\AppData\Local\Temp\c2yaa50hfk1.exe
    "C:\Users\Admin\AppData\Local\Temp\c2yaa50hfk1.exe"
    3⤵
    PID:27752
- C:\Users\Admin\AppData\Local\Temp\kuqg1itw43a.exe
  "C:\Users\Admin\AppData\Local\Temp\kuqg1itw43a.exe"
  2⤵
  - Executes dropped EXE
  PID:3412
- - C:\Users\Admin\AppData\Local\Temp\n2wisw0oblk.exe
    "C:\Users\Admin\AppData\Local\Temp\n2wisw0oblk.exe"
    3⤵
    PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\gf4t5ypekal.exe
      "C:\Users\Admin\AppData\Local\Temp\gf4t5ypekal.exe"
      4⤵
      PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\ivwlgsvyz0h.exe
      "C:\Users\Admin\AppData\Local\Temp\ivwlgsvyz0h.exe"
      4⤵
      PID:19936
  - - C:\Users\Admin\AppData\Local\Temp\hoparzygwxk.exe
      "C:\Users\Admin\AppData\Local\Temp\hoparzygwxk.exe"
      4⤵
      PID:21856
  - - C:\Users\Admin\AppData\Local\Temp\vkix50d420m.exe
      "C:\Users\Admin\AppData\Local\Temp\vkix50d420m.exe"
      4⤵
      PID:24684
  - - C:\Users\Admin\AppData\Local\Temp\rfnvmxxzskw.exe
      "C:\Users\Admin\AppData\Local\Temp\rfnvmxxzskw.exe"
      4⤵
      PID:22200
  - - C:\Users\Admin\AppData\Local\Temp\agipwkzxmny.exe
      "C:\Users\Admin\AppData\Local\Temp\agipwkzxmny.exe"
      4⤵
      PID:14532
- - C:\Users\Admin\AppData\Local\Temp\rwwdgkhmebh.exe
    "C:\Users\Admin\AppData\Local\Temp\rwwdgkhmebh.exe"
    3⤵
    PID:6984
  - - C:\Users\Admin\AppData\Local\Temp\sqzxb3cgp4q.exe
      "C:\Users\Admin\AppData\Local\Temp\sqzxb3cgp4q.exe"
      4⤵
      PID:19768
  - - C:\Users\Admin\AppData\Local\Temp\c41lojtb3ac.exe
      "C:\Users\Admin\AppData\Local\Temp\c41lojtb3ac.exe"
      4⤵
      PID:21000
  - - C:\Users\Admin\AppData\Local\Temp\s3hgkonpdpr.exe
      "C:\Users\Admin\AppData\Local\Temp\s3hgkonpdpr.exe"
      4⤵
      PID:26696
  - - C:\Users\Admin\AppData\Local\Temp\33iqqndj0cu.exe
      "C:\Users\Admin\AppData\Local\Temp\33iqqndj0cu.exe"
      4⤵
      PID:20100
  - - C:\Users\Admin\AppData\Local\Temp\vzz5irq10tq.exe
      "C:\Users\Admin\AppData\Local\Temp\vzz5irq10tq.exe"
      4⤵
      PID:35596
- - C:\Users\Admin\AppData\Local\Temp\2wcpeuzq1oz.exe
    "C:\Users\Admin\AppData\Local\Temp\2wcpeuzq1oz.exe"
    3⤵
    PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\3d2txjepkpu.exe
      "C:\Users\Admin\AppData\Local\Temp\3d2txjepkpu.exe"
      4⤵
      PID:24292
  - - C:\Users\Admin\AppData\Local\Temp\fmzbuiwymjj.exe
      "C:\Users\Admin\AppData\Local\Temp\fmzbuiwymjj.exe"
      4⤵
      PID:26780
  - - C:\Users\Admin\AppData\Local\Temp\az2q5uffuju.exe
      "C:\Users\Admin\AppData\Local\Temp\az2q5uffuju.exe"
      4⤵
      PID:1332
- - C:\Users\Admin\AppData\Local\Temp\1nejs4gedua.exe
    "C:\Users\Admin\AppData\Local\Temp\1nejs4gedua.exe"
    3⤵
    PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\dg434qqvoal.exe
      "C:\Users\Admin\AppData\Local\Temp\dg434qqvoal.exe"
      4⤵
      PID:28504
  - - C:\Users\Admin\AppData\Local\Temp\a1b25na4wuo.exe
      "C:\Users\Admin\AppData\Local\Temp\a1b25na4wuo.exe"
      4⤵
      PID:32448
- - C:\Users\Admin\AppData\Local\Temp\jqpn1ksedsd.exe
    "C:\Users\Admin\AppData\Local\Temp\jqpn1ksedsd.exe"
    3⤵
    PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\ph3ytf1qmbc.exe
      "C:\Users\Admin\AppData\Local\Temp\ph3ytf1qmbc.exe"
      4⤵
      PID:34788
- - C:\Users\Admin\AppData\Local\Temp\oaby4bbfipr.exe
    "C:\Users\Admin\AppData\Local\Temp\oaby4bbfipr.exe"
    3⤵
    PID:14136
- - C:\Users\Admin\AppData\Local\Temp\pgvqlp3k4jj.exe
    "C:\Users\Admin\AppData\Local\Temp\pgvqlp3k4jj.exe"
    3⤵
    PID:14840
- - C:\Users\Admin\AppData\Local\Temp\gfv43vlbww1.exe
    "C:\Users\Admin\AppData\Local\Temp\gfv43vlbww1.exe"
    3⤵
    PID:23084
- - C:\Users\Admin\AppData\Local\Temp\wny5pymggme.exe
    "C:\Users\Admin\AppData\Local\Temp\wny5pymggme.exe"
    3⤵
    PID:23432
- - C:\Users\Admin\AppData\Local\Temp\dozqgg5padj.exe
    "C:\Users\Admin\AppData\Local\Temp\dozqgg5padj.exe"
    3⤵
    PID:25604
- - C:\Users\Admin\AppData\Local\Temp\n1inccpd24t.exe
    "C:\Users\Admin\AppData\Local\Temp\n1inccpd24t.exe"
    3⤵
    PID:27832
- C:\Users\Admin\AppData\Local\Temp\ouogwmmxntn.exe
  "C:\Users\Admin\AppData\Local\Temp\ouogwmmxntn.exe"
  2⤵
  - Executes dropped EXE
  PID:4392
- - C:\Users\Admin\AppData\Local\Temp\wo1vitudav5.exe
    "C:\Users\Admin\AppData\Local\Temp\wo1vitudav5.exe"
    3⤵
    PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\4qk5bvq3rzc.exe
      "C:\Users\Admin\AppData\Local\Temp\4qk5bvq3rzc.exe"
      4⤵
      PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\e4h5hfbaeri.exe
      "C:\Users\Admin\AppData\Local\Temp\e4h5hfbaeri.exe"
      4⤵
      PID:28932
- - C:\Users\Admin\AppData\Local\Temp\d5fwi1ll10k.exe
    "C:\Users\Admin\AppData\Local\Temp\d5fwi1ll10k.exe"
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\f1rd0ahaysp.exe
      "C:\Users\Admin\AppData\Local\Temp\f1rd0ahaysp.exe"
      4⤵
      PID:14304
  - - C:\Users\Admin\AppData\Local\Temp\5flt00dtx3k.exe
      "C:\Users\Admin\AppData\Local\Temp\5flt00dtx3k.exe"
      4⤵
      PID:18660
  - - C:\Users\Admin\AppData\Local\Temp\lkxudewk1mz.exe
      "C:\Users\Admin\AppData\Local\Temp\lkxudewk1mz.exe"
      4⤵
      PID:8060
- - C:\Users\Admin\AppData\Local\Temp\k2f1f00tha4.exe
    "C:\Users\Admin\AppData\Local\Temp\k2f1f00tha4.exe"
    3⤵
    PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\fzkqtoiittw.exe
      "C:\Users\Admin\AppData\Local\Temp\fzkqtoiittw.exe"
      4⤵
      PID:20820
  - - C:\Users\Admin\AppData\Local\Temp\kqzcqfe2dii.exe
      "C:\Users\Admin\AppData\Local\Temp\kqzcqfe2dii.exe"
      4⤵
      PID:23944
  - - C:\Users\Admin\AppData\Local\Temp\cch20culqdz.exe
      "C:\Users\Admin\AppData\Local\Temp\cch20culqdz.exe"
      4⤵
      PID:27252
  - - C:\Users\Admin\AppData\Local\Temp\j3tdojdwhhe.exe
      "C:\Users\Admin\AppData\Local\Temp\j3tdojdwhhe.exe"
      4⤵
      PID:27384
  - - C:\Users\Admin\AppData\Local\Temp\usgzz0dyshn.exe
      "C:\Users\Admin\AppData\Local\Temp\usgzz0dyshn.exe"
      4⤵
      PID:23500
- - C:\Users\Admin\AppData\Local\Temp\ypg3pqad0v3.exe
    "C:\Users\Admin\AppData\Local\Temp\ypg3pqad0v3.exe"
    3⤵
    PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\nxdy2nhp1r0.exe
      "C:\Users\Admin\AppData\Local\Temp\nxdy2nhp1r0.exe"
      4⤵
      PID:19608
  - - C:\Users\Admin\AppData\Local\Temp\zjniu2vt3id.exe
      "C:\Users\Admin\AppData\Local\Temp\zjniu2vt3id.exe"
      4⤵
      PID:21640
  - - C:\Users\Admin\AppData\Local\Temp\sl152p2bd0l.exe
      "C:\Users\Admin\AppData\Local\Temp\sl152p2bd0l.exe"
      4⤵
      PID:24424
  - - C:\Users\Admin\AppData\Local\Temp\mlxupkrmk33.exe
      "C:\Users\Admin\AppData\Local\Temp\mlxupkrmk33.exe"
      4⤵
      PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\lbuqhdqsck0.exe
      "C:\Users\Admin\AppData\Local\Temp\lbuqhdqsck0.exe"
      4⤵
      PID:31092
- - C:\Users\Admin\AppData\Local\Temp\g0fcns2pkwz.exe
    "C:\Users\Admin\AppData\Local\Temp\g0fcns2pkwz.exe"
    3⤵
    PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\4naalakos5c.exe
      "C:\Users\Admin\AppData\Local\Temp\4naalakos5c.exe"
      4⤵
      PID:32240
- - C:\Users\Admin\AppData\Local\Temp\5jbibx5bzqe.exe
    "C:\Users\Admin\AppData\Local\Temp\5jbibx5bzqe.exe"
    3⤵
    PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\e3vy3rhyxqi.exe
      "C:\Users\Admin\AppData\Local\Temp\e3vy3rhyxqi.exe"
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\mkpdwsvcm4h.exe
    "C:\Users\Admin\AppData\Local\Temp\mkpdwsvcm4h.exe"
    3⤵
    PID:12960
- - C:\Users\Admin\AppData\Local\Temp\2wp0nj41ggt.exe
    "C:\Users\Admin\AppData\Local\Temp\2wp0nj41ggt.exe"
    3⤵
    PID:16168
- - C:\Users\Admin\AppData\Local\Temp\0da42yt4ft0.exe
    "C:\Users\Admin\AppData\Local\Temp\0da42yt4ft0.exe"
    3⤵
    PID:16388
- - C:\Users\Admin\AppData\Local\Temp\gebcqwljdi5.exe
    "C:\Users\Admin\AppData\Local\Temp\gebcqwljdi5.exe"
    3⤵
    PID:4488
- - C:\Users\Admin\AppData\Local\Temp\becahfrv1dn.exe
    "C:\Users\Admin\AppData\Local\Temp\becahfrv1dn.exe"
    3⤵
    PID:22180
- - C:\Users\Admin\AppData\Local\Temp\tsj05a4js5y.exe
    "C:\Users\Admin\AppData\Local\Temp\tsj05a4js5y.exe"
    3⤵
    PID:22296
- - C:\Users\Admin\AppData\Local\Temp\sw2m5uumj1s.exe
    "C:\Users\Admin\AppData\Local\Temp\sw2m5uumj1s.exe"
    3⤵
    PID:9348
- - C:\Users\Admin\AppData\Local\Temp\paxi3jp3ydp.exe
    "C:\Users\Admin\AppData\Local\Temp\paxi3jp3ydp.exe"
    3⤵
    PID:29680
- - C:\Users\Admin\AppData\Local\Temp\xuq4x3vcpgt.exe
    "C:\Users\Admin\AppData\Local\Temp\xuq4x3vcpgt.exe"
    3⤵
    PID:32052
- - C:\Users\Admin\AppData\Local\Temp\qc2zkrylaz1.exe
    "C:\Users\Admin\AppData\Local\Temp\qc2zkrylaz1.exe"
    3⤵
    PID:34396
- C:\Users\Admin\AppData\Local\Temp\w0gfhwyj3hw.exe
  "C:\Users\Admin\AppData\Local\Temp\w0gfhwyj3hw.exe"
  2⤵
  - Executes dropped EXE
  PID:2132
- - C:\Users\Admin\AppData\Local\Temp\hr2epw5ufnk.exe
    "C:\Users\Admin\AppData\Local\Temp\hr2epw5ufnk.exe"
    3⤵
    PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\xkxrdknholr.exe
      "C:\Users\Admin\AppData\Local\Temp\xkxrdknholr.exe"
      4⤵
      PID:19060
  - - C:\Users\Admin\AppData\Local\Temp\d545nkoikbp.exe
      "C:\Users\Admin\AppData\Local\Temp\d545nkoikbp.exe"
      4⤵
      PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\xhk1r3jbb1o.exe
      "C:\Users\Admin\AppData\Local\Temp\xhk1r3jbb1o.exe"
      4⤵
      PID:24520
  - - C:\Users\Admin\AppData\Local\Temp\e1nkrda5lkq.exe
      "C:\Users\Admin\AppData\Local\Temp\e1nkrda5lkq.exe"
      4⤵
      PID:26300
  - - C:\Users\Admin\AppData\Local\Temp\zncay5fblng.exe
      "C:\Users\Admin\AppData\Local\Temp\zncay5fblng.exe"
      4⤵
      PID:32044
- - C:\Users\Admin\AppData\Local\Temp\tpkuu5bl3in.exe
    "C:\Users\Admin\AppData\Local\Temp\tpkuu5bl3in.exe"
    3⤵
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\yurxpeyoao2.exe
      "C:\Users\Admin\AppData\Local\Temp\yurxpeyoao2.exe"
      4⤵
      PID:19128
  - - C:\Users\Admin\AppData\Local\Temp\01qeln4llnt.exe
      "C:\Users\Admin\AppData\Local\Temp\01qeln4llnt.exe"
      4⤵
      PID:19200
  - - C:\Users\Admin\AppData\Local\Temp\poezfn4iky3.exe
      "C:\Users\Admin\AppData\Local\Temp\poezfn4iky3.exe"
      4⤵
      PID:23744
  - - C:\Users\Admin\AppData\Local\Temp\xdghuethywh.exe
      "C:\Users\Admin\AppData\Local\Temp\xdghuethywh.exe"
      4⤵
      PID:26944
  - - C:\Users\Admin\AppData\Local\Temp\u0k2pavywvr.exe
      "C:\Users\Admin\AppData\Local\Temp\u0k2pavywvr.exe"
      4⤵
      PID:29460
  - - C:\Users\Admin\AppData\Local\Temp\mdh41i0s3y5.exe
      "C:\Users\Admin\AppData\Local\Temp\mdh41i0s3y5.exe"
      4⤵
      PID:30824
- - C:\Users\Admin\AppData\Local\Temp\nirz2gya1oj.exe
    "C:\Users\Admin\AppData\Local\Temp\nirz2gya1oj.exe"
    3⤵
    PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\mkqnsw1zz4a.exe
      "C:\Users\Admin\AppData\Local\Temp\mkqnsw1zz4a.exe"
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\coiylmgj3ik.exe
      "C:\Users\Admin\AppData\Local\Temp\coiylmgj3ik.exe"
      4⤵
      PID:29704
- - C:\Users\Admin\AppData\Local\Temp\sk4xxityngq.exe
    "C:\Users\Admin\AppData\Local\Temp\sk4xxityngq.exe"
    3⤵
    PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\v0x1o5lgtsu.exe
      "C:\Users\Admin\AppData\Local\Temp\v0x1o5lgtsu.exe"
      4⤵
      PID:18000
  - - C:\Users\Admin\AppData\Local\Temp\3zkjach1jl3.exe
      "C:\Users\Admin\AppData\Local\Temp\3zkjach1jl3.exe"
      4⤵
      PID:23968
  - - C:\Users\Admin\AppData\Local\Temp\rrldlzx153w.exe
      "C:\Users\Admin\AppData\Local\Temp\rrldlzx153w.exe"
      4⤵
      PID:25116
  - - C:\Users\Admin\AppData\Local\Temp\q05adosh332.exe
      "C:\Users\Admin\AppData\Local\Temp\q05adosh332.exe"
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\xa4mxcqaxwz.exe
    "C:\Users\Admin\AppData\Local\Temp\xa4mxcqaxwz.exe"
    3⤵
    PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\1wtwcv3mey4.exe
      "C:\Users\Admin\AppData\Local\Temp\1wtwcv3mey4.exe"
      4⤵
      PID:23616
  - - C:\Users\Admin\AppData\Local\Temp\qsy5hybpl1z.exe
      "C:\Users\Admin\AppData\Local\Temp\qsy5hybpl1z.exe"
      4⤵
      PID:20856
  - - C:\Users\Admin\AppData\Local\Temp\nsewqevrqqp.exe
      "C:\Users\Admin\AppData\Local\Temp\nsewqevrqqp.exe"
      4⤵
      PID:32456
- - C:\Users\Admin\AppData\Local\Temp\smvjnyxw4em.exe
    "C:\Users\Admin\AppData\Local\Temp\smvjnyxw4em.exe"
    3⤵
    PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\oogj2uf3fth.exe
      "C:\Users\Admin\AppData\Local\Temp\oogj2uf3fth.exe"
      4⤵
      PID:35408
- - C:\Users\Admin\AppData\Local\Temp\rm24jxav5ok.exe
    "C:\Users\Admin\AppData\Local\Temp\rm24jxav5ok.exe"
    3⤵
    PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\aib4sjmmkff.exe
      "C:\Users\Admin\AppData\Local\Temp\aib4sjmmkff.exe"
      4⤵
      PID:34748
- - C:\Users\Admin\AppData\Local\Temp\1qeomxpn0t3.exe
    "C:\Users\Admin\AppData\Local\Temp\1qeomxpn0t3.exe"
    3⤵
    PID:12104
- - C:\Users\Admin\AppData\Local\Temp\4j0stexlksg.exe
    "C:\Users\Admin\AppData\Local\Temp\4j0stexlksg.exe"
    3⤵
    PID:15444
- - C:\Users\Admin\AppData\Local\Temp\4m3tmgqlbaq.exe
    "C:\Users\Admin\AppData\Local\Temp\4m3tmgqlbaq.exe"
    3⤵
    PID:17384
- - C:\Users\Admin\AppData\Local\Temp\vpjlhmwq0vu.exe
    "C:\Users\Admin\AppData\Local\Temp\vpjlhmwq0vu.exe"
    3⤵
    PID:17112
- - C:\Users\Admin\AppData\Local\Temp\lcs3lwe4rbw.exe
    "C:\Users\Admin\AppData\Local\Temp\lcs3lwe4rbw.exe"
    3⤵
    PID:23236
- - C:\Users\Admin\AppData\Local\Temp\3lsjuit3m4g.exe
    "C:\Users\Admin\AppData\Local\Temp\3lsjuit3m4g.exe"
    3⤵
    PID:25572
- - C:\Users\Admin\AppData\Local\Temp\nwa1oo22ude.exe
    "C:\Users\Admin\AppData\Local\Temp\nwa1oo22ude.exe"
    3⤵
    PID:27052
- - C:\Users\Admin\AppData\Local\Temp\ux2g0k2qfgu.exe
    "C:\Users\Admin\AppData\Local\Temp\ux2g0k2qfgu.exe"
    3⤵
    PID:26848
- - C:\Users\Admin\AppData\Local\Temp\vnzxeain5t5.exe
    "C:\Users\Admin\AppData\Local\Temp\vnzxeain5t5.exe"
    3⤵
    PID:29720
- C:\Users\Admin\AppData\Local\Temp\15wvgcvxhp0.exe
  "C:\Users\Admin\AppData\Local\Temp\15wvgcvxhp0.exe"
  2⤵
  - Executes dropped EXE
  PID:3560
- - C:\Users\Admin\AppData\Local\Temp\iya1gy5uybh.exe
    "C:\Users\Admin\AppData\Local\Temp\iya1gy5uybh.exe"
    3⤵
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\upzrwr0turj.exe
      "C:\Users\Admin\AppData\Local\Temp\upzrwr0turj.exe"
      4⤵
      PID:29088
  - - C:\Users\Admin\AppData\Local\Temp\i2xt4j0od1f.exe
      "C:\Users\Admin\AppData\Local\Temp\i2xt4j0od1f.exe"
      4⤵
      PID:31284
- - C:\Users\Admin\AppData\Local\Temp\z1wybyqgfox.exe
    "C:\Users\Admin\AppData\Local\Temp\z1wybyqgfox.exe"
    3⤵
    PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\ln5xqxfussu.exe
      "C:\Users\Admin\AppData\Local\Temp\ln5xqxfussu.exe"
      4⤵
      PID:24960
- - C:\Users\Admin\AppData\Local\Temp\e2kcco1dsaf.exe
    "C:\Users\Admin\AppData\Local\Temp\e2kcco1dsaf.exe"
    3⤵
    PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\a0xglfecygt.exe
      "C:\Users\Admin\AppData\Local\Temp\a0xglfecygt.exe"
      4⤵
      PID:34764
- - C:\Users\Admin\AppData\Local\Temp\of1xgcq3uyl.exe
    "C:\Users\Admin\AppData\Local\Temp\of1xgcq3uyl.exe"
    3⤵
    PID:12072
- - C:\Users\Admin\AppData\Local\Temp\ulrxo54y4ad.exe
    "C:\Users\Admin\AppData\Local\Temp\ulrxo54y4ad.exe"
    3⤵
    PID:13896
- - C:\Users\Admin\AppData\Local\Temp\o0m51lkxaa0.exe
    "C:\Users\Admin\AppData\Local\Temp\o0m51lkxaa0.exe"
    3⤵
    PID:15028
- - C:\Users\Admin\AppData\Local\Temp\ibyyi5qhhun.exe
    "C:\Users\Admin\AppData\Local\Temp\ibyyi5qhhun.exe"
    3⤵
    PID:18620
- - C:\Users\Admin\AppData\Local\Temp\qjqh2i5wci5.exe
    "C:\Users\Admin\AppData\Local\Temp\qjqh2i5wci5.exe"
    3⤵
    PID:22052
- - C:\Users\Admin\AppData\Local\Temp\jjhlab5kvnh.exe
    "C:\Users\Admin\AppData\Local\Temp\jjhlab5kvnh.exe"
    3⤵
    PID:24900
- - C:\Users\Admin\AppData\Local\Temp\xkuwdpanpkl.exe
    "C:\Users\Admin\AppData\Local\Temp\xkuwdpanpkl.exe"
    3⤵
    PID:28460
- - C:\Users\Admin\AppData\Local\Temp\pjzl2rjixvx.exe
    "C:\Users\Admin\AppData\Local\Temp\pjzl2rjixvx.exe"
    3⤵
    PID:25344
- - C:\Users\Admin\AppData\Local\Temp\fh0e30f10xy.exe
    "C:\Users\Admin\AppData\Local\Temp\fh0e30f10xy.exe"
    3⤵
    PID:15336
- C:\Users\Admin\AppData\Local\Temp\j0adlig0bru.exe
  "C:\Users\Admin\AppData\Local\Temp\j0adlig0bru.exe"
  2⤵
  - Executes dropped EXE
  PID:1132
- - C:\Users\Admin\AppData\Local\Temp\tx2aonbl0qs.exe
    "C:\Users\Admin\AppData\Local\Temp\tx2aonbl0qs.exe"
    3⤵
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\rb4pqibqa3x.exe
      "C:\Users\Admin\AppData\Local\Temp\rb4pqibqa3x.exe"
      4⤵
      PID:20796
  - - C:\Users\Admin\AppData\Local\Temp\vlxm0bowi2e.exe
      "C:\Users\Admin\AppData\Local\Temp\vlxm0bowi2e.exe"
      4⤵
      PID:24692
  - - C:\Users\Admin\AppData\Local\Temp\wc4bgewzwzf.exe
      "C:\Users\Admin\AppData\Local\Temp\wc4bgewzwzf.exe"
      4⤵
      PID:28516
  - - C:\Users\Admin\AppData\Local\Temp\hsg5rhcnaxe.exe
      "C:\Users\Admin\AppData\Local\Temp\hsg5rhcnaxe.exe"
      4⤵
      PID:28536
  - - C:\Users\Admin\AppData\Local\Temp\q11k0fadkta.exe
      "C:\Users\Admin\AppData\Local\Temp\q11k0fadkta.exe"
      4⤵
      PID:15692
- - C:\Users\Admin\AppData\Local\Temp\gzz3qo1gxgb.exe
    "C:\Users\Admin\AppData\Local\Temp\gzz3qo1gxgb.exe"
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\qtuu2z5sqqi.exe
      "C:\Users\Admin\AppData\Local\Temp\qtuu2z5sqqi.exe"
      4⤵
      PID:20112
  - - C:\Users\Admin\AppData\Local\Temp\0yvpepi54wk.exe
      "C:\Users\Admin\AppData\Local\Temp\0yvpepi54wk.exe"
      4⤵
      PID:22308
  - - C:\Users\Admin\AppData\Local\Temp\004s31mlcxr.exe
      "C:\Users\Admin\AppData\Local\Temp\004s31mlcxr.exe"
      4⤵
      PID:20936
  - - C:\Users\Admin\AppData\Local\Temp\joatv4ivhfd.exe
      "C:\Users\Admin\AppData\Local\Temp\joatv4ivhfd.exe"
      4⤵
      PID:27672
  - - C:\Users\Admin\AppData\Local\Temp\yvytwj3145j.exe
      "C:\Users\Admin\AppData\Local\Temp\yvytwj3145j.exe"
      4⤵
      PID:32584
- - C:\Users\Admin\AppData\Local\Temp\kp452dulqwv.exe
    "C:\Users\Admin\AppData\Local\Temp\kp452dulqwv.exe"
    3⤵
    PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\j41dvl3hdaw.exe
      "C:\Users\Admin\AppData\Local\Temp\j41dvl3hdaw.exe"
      4⤵
      PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\gaae2jdi4tj.exe
      "C:\Users\Admin\AppData\Local\Temp\gaae2jdi4tj.exe"
      4⤵
      PID:26028
- - C:\Users\Admin\AppData\Local\Temp\jbmp0ck1au1.exe
    "C:\Users\Admin\AppData\Local\Temp\jbmp0ck1au1.exe"
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\qs2xeppx2ly.exe
      "C:\Users\Admin\AppData\Local\Temp\qs2xeppx2ly.exe"
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\0rcfm3av1zr.exe
      "C:\Users\Admin\AppData\Local\Temp\0rcfm3av1zr.exe"
      4⤵
      PID:20068
  - - C:\Users\Admin\AppData\Local\Temp\v0de5v3t22z.exe
      "C:\Users\Admin\AppData\Local\Temp\v0de5v3t22z.exe"
      4⤵
      PID:20660
  - - C:\Users\Admin\AppData\Local\Temp\akkzwprfhsy.exe
      "C:\Users\Admin\AppData\Local\Temp\akkzwprfhsy.exe"
      4⤵
      PID:26160
  - - C:\Users\Admin\AppData\Local\Temp\2mwjx13i3nt.exe
      "C:\Users\Admin\AppData\Local\Temp\2mwjx13i3nt.exe"
      4⤵
      PID:10044
- - C:\Users\Admin\AppData\Local\Temp\snfebulocrs.exe
    "C:\Users\Admin\AppData\Local\Temp\snfebulocrs.exe"
    3⤵
    PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\fsabuj23n3c.exe
      "C:\Users\Admin\AppData\Local\Temp\fsabuj23n3c.exe"
      4⤵
      PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\hkpfubu0twt.exe
      "C:\Users\Admin\AppData\Local\Temp\hkpfubu0twt.exe"
      4⤵
      PID:18044
  - - C:\Users\Admin\AppData\Local\Temp\rryrh5fywjf.exe
      "C:\Users\Admin\AppData\Local\Temp\rryrh5fywjf.exe"
      4⤵
      PID:22280
  - - C:\Users\Admin\AppData\Local\Temp\lyiygxhgfvt.exe
      "C:\Users\Admin\AppData\Local\Temp\lyiygxhgfvt.exe"
      4⤵
      PID:21828
  - - C:\Users\Admin\AppData\Local\Temp\5czh2gxlptb.exe
      "C:\Users\Admin\AppData\Local\Temp\5czh2gxlptb.exe"
      4⤵
      PID:28340
  - - C:\Users\Admin\AppData\Local\Temp\0cb351wdp4f.exe
      "C:\Users\Admin\AppData\Local\Temp\0cb351wdp4f.exe"
      4⤵
      PID:27468
- - C:\Users\Admin\AppData\Local\Temp\24f2ry32a0w.exe
    "C:\Users\Admin\AppData\Local\Temp\24f2ry32a0w.exe"
    3⤵
    PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\yozfi1l0ido.exe
      "C:\Users\Admin\AppData\Local\Temp\yozfi1l0ido.exe"
      4⤵
      PID:20812
  - - C:\Users\Admin\AppData\Local\Temp\sdfjouysuhd.exe
      "C:\Users\Admin\AppData\Local\Temp\sdfjouysuhd.exe"
      4⤵
      PID:23496
  - - C:\Users\Admin\AppData\Local\Temp\yyl3fopypcz.exe
      "C:\Users\Admin\AppData\Local\Temp\yyl3fopypcz.exe"
      4⤵
      PID:24064
  - - C:\Users\Admin\AppData\Local\Temp\tkjkojsznri.exe
      "C:\Users\Admin\AppData\Local\Temp\tkjkojsznri.exe"
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\ufw4tqcd01r.exe
      "C:\Users\Admin\AppData\Local\Temp\ufw4tqcd01r.exe"
      4⤵
      PID:20968
  - - C:\Users\Admin\AppData\Local\Temp\x2x0wtrs4y5.exe
      "C:\Users\Admin\AppData\Local\Temp\x2x0wtrs4y5.exe"
      4⤵
      PID:32516
- - C:\Users\Admin\AppData\Local\Temp\z34y3yg1iza.exe
    "C:\Users\Admin\AppData\Local\Temp\z34y3yg1iza.exe"
    3⤵
    PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\vqiz0un2upj.exe
      "C:\Users\Admin\AppData\Local\Temp\vqiz0un2upj.exe"
      4⤵
      PID:28568
  - - C:\Users\Admin\AppData\Local\Temp\d0rik0ojjmm.exe
      "C:\Users\Admin\AppData\Local\Temp\d0rik0ojjmm.exe"
      4⤵
      PID:25424
  - - C:\Users\Admin\AppData\Local\Temp\uij0vyet1aa.exe
      "C:\Users\Admin\AppData\Local\Temp\uij0vyet1aa.exe"
      4⤵
      PID:15024
- - C:\Users\Admin\AppData\Local\Temp\em5dd5ihqcj.exe
    "C:\Users\Admin\AppData\Local\Temp\em5dd5ihqcj.exe"
    3⤵
    PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\htbwokagu33.exe
      "C:\Users\Admin\AppData\Local\Temp\htbwokagu33.exe"
      4⤵
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\mulq3pgjypf.exe
      "C:\Users\Admin\AppData\Local\Temp\mulq3pgjypf.exe"
      4⤵
      PID:34348
- - C:\Users\Admin\AppData\Local\Temp\mzmddumbtja.exe
    "C:\Users\Admin\AppData\Local\Temp\mzmddumbtja.exe"
    3⤵
    PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\fnrrnjqx2mi.exe
      "C:\Users\Admin\AppData\Local\Temp\fnrrnjqx2mi.exe"
      4⤵
      PID:31592
- - C:\Users\Admin\AppData\Local\Temp\u5kszqamigv.exe
    "C:\Users\Admin\AppData\Local\Temp\u5kszqamigv.exe"
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\2z3brwm3oi2.exe
    "C:\Users\Admin\AppData\Local\Temp\2z3brwm3oi2.exe"
    3⤵
    PID:13296
- - C:\Users\Admin\AppData\Local\Temp\h3o5mg300l2.exe
    "C:\Users\Admin\AppData\Local\Temp\h3o5mg300l2.exe"
    3⤵
    PID:13820
- - C:\Users\Admin\AppData\Local\Temp\vpyrvrvihkj.exe
    "C:\Users\Admin\AppData\Local\Temp\vpyrvrvihkj.exe"
    3⤵
    PID:23752
- - C:\Users\Admin\AppData\Local\Temp\d1ikdalva2z.exe
    "C:\Users\Admin\AppData\Local\Temp\d1ikdalva2z.exe"
    3⤵
    PID:26920
- - C:\Users\Admin\AppData\Local\Temp\1ju4xgvtizz.exe
    "C:\Users\Admin\AppData\Local\Temp\1ju4xgvtizz.exe"
    3⤵
    PID:29304
- - C:\Users\Admin\AppData\Local\Temp\ijfs3shyntz.exe
    "C:\Users\Admin\AppData\Local\Temp\ijfs3shyntz.exe"
    3⤵
    PID:31352
- C:\Users\Admin\AppData\Local\Temp\uydcpoesr4y.exe
  "C:\Users\Admin\AppData\Local\Temp\uydcpoesr4y.exe"
  2⤵
  - Executes dropped EXE
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\ferorybxorc.exe
    "C:\Users\Admin\AppData\Local\Temp\ferorybxorc.exe"
    3⤵
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\relcw3gir4y.exe
      "C:\Users\Admin\AppData\Local\Temp\relcw3gir4y.exe"
      4⤵
      PID:24368
  - - C:\Users\Admin\AppData\Local\Temp\yx0r2ddawpo.exe
      "C:\Users\Admin\AppData\Local\Temp\yx0r2ddawpo.exe"
      4⤵
      PID:21436
  - - C:\Users\Admin\AppData\Local\Temp\fsrzqpfh4ph.exe
      "C:\Users\Admin\AppData\Local\Temp\fsrzqpfh4ph.exe"
      4⤵
      PID:13588
- - C:\Users\Admin\AppData\Local\Temp\3ne4dt0cyn5.exe
    "C:\Users\Admin\AppData\Local\Temp\3ne4dt0cyn5.exe"
    3⤵
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\zcpiyju3qja.exe
      "C:\Users\Admin\AppData\Local\Temp\zcpiyju3qja.exe"
      4⤵
      PID:20284
  - - C:\Users\Admin\AppData\Local\Temp\z4gbmxvnds3.exe
      "C:\Users\Admin\AppData\Local\Temp\z4gbmxvnds3.exe"
      4⤵
      PID:30864
- - C:\Users\Admin\AppData\Local\Temp\ktvqao440yv.exe
    "C:\Users\Admin\AppData\Local\Temp\ktvqao440yv.exe"
    3⤵
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\g01h0ieiytf.exe
      "C:\Users\Admin\AppData\Local\Temp\g01h0ieiytf.exe"
      4⤵
      PID:16404
  - - C:\Users\Admin\AppData\Local\Temp\c2r24p45g0i.exe
      "C:\Users\Admin\AppData\Local\Temp\c2r24p45g0i.exe"
      4⤵
      PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\fu1sbef2lyu.exe
      "C:\Users\Admin\AppData\Local\Temp\fu1sbef2lyu.exe"
      4⤵
      PID:19904
  - - C:\Users\Admin\AppData\Local\Temp\gnhdfvsn5mx.exe
      "C:\Users\Admin\AppData\Local\Temp\gnhdfvsn5mx.exe"
      4⤵
      PID:24864
  - - C:\Users\Admin\AppData\Local\Temp\vhi0obdolkb.exe
      "C:\Users\Admin\AppData\Local\Temp\vhi0obdolkb.exe"
      4⤵
      PID:22092
  - - C:\Users\Admin\AppData\Local\Temp\cjeffet2tkb.exe
      "C:\Users\Admin\AppData\Local\Temp\cjeffet2tkb.exe"
      4⤵
      PID:27336
  - - C:\Users\Admin\AppData\Local\Temp\wsmmqjrtat5.exe
      "C:\Users\Admin\AppData\Local\Temp\wsmmqjrtat5.exe"
      4⤵
      PID:27232
  - - C:\Users\Admin\AppData\Local\Temp\nb0pzkantcn.exe
      "C:\Users\Admin\AppData\Local\Temp\nb0pzkantcn.exe"
      4⤵
      PID:31140
  - - C:\Users\Admin\AppData\Local\Temp\aaoxzqvl4la.exe
      "C:\Users\Admin\AppData\Local\Temp\aaoxzqvl4la.exe"
      4⤵
      PID:31784
- - C:\Users\Admin\AppData\Local\Temp\a5wirp552ei.exe
    "C:\Users\Admin\AppData\Local\Temp\a5wirp552ei.exe"
    3⤵
    PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\j0s2tcimqpx.exe
      "C:\Users\Admin\AppData\Local\Temp\j0s2tcimqpx.exe"
      4⤵
      PID:18376
  - - C:\Users\Admin\AppData\Local\Temp\0wwmyooefix.exe
      "C:\Users\Admin\AppData\Local\Temp\0wwmyooefix.exe"
      4⤵
      PID:20748
  - - C:\Users\Admin\AppData\Local\Temp\nk4mwn24ci5.exe
      "C:\Users\Admin\AppData\Local\Temp\nk4mwn24ci5.exe"
      4⤵
      PID:24336
  - - C:\Users\Admin\AppData\Local\Temp\euvme0wefuh.exe
      "C:\Users\Admin\AppData\Local\Temp\euvme0wefuh.exe"
      4⤵
      PID:26960
  - - C:\Users\Admin\AppData\Local\Temp\ff2uhyto01a.exe
      "C:\Users\Admin\AppData\Local\Temp\ff2uhyto01a.exe"
      4⤵
      PID:26784
- - C:\Users\Admin\AppData\Local\Temp\mejicgvcxa3.exe
    "C:\Users\Admin\AppData\Local\Temp\mejicgvcxa3.exe"
    3⤵
    PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\fdpy4szdg5d.exe
      "C:\Users\Admin\AppData\Local\Temp\fdpy4szdg5d.exe"
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\vejppelyoqn.exe
      "C:\Users\Admin\AppData\Local\Temp\vejppelyoqn.exe"
      4⤵
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\nezudmv4smj.exe
      "C:\Users\Admin\AppData\Local\Temp\nezudmv4smj.exe"
      4⤵
      PID:26796
  - - C:\Users\Admin\AppData\Local\Temp\uhsavvedhkh.exe
      "C:\Users\Admin\AppData\Local\Temp\uhsavvedhkh.exe"
      4⤵
      PID:29516
  - - C:\Users\Admin\AppData\Local\Temp\oaycwataih3.exe
      "C:\Users\Admin\AppData\Local\Temp\oaycwataih3.exe"
      4⤵
      PID:15700
- - C:\Users\Admin\AppData\Local\Temp\tajoqr51hdn.exe
    "C:\Users\Admin\AppData\Local\Temp\tajoqr51hdn.exe"
    3⤵
    PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\vsko0y5vqsf.exe
      "C:\Users\Admin\AppData\Local\Temp\vsko0y5vqsf.exe"
      4⤵
      PID:18972
  - - C:\Users\Admin\AppData\Local\Temp\1ewlwelipif.exe
      "C:\Users\Admin\AppData\Local\Temp\1ewlwelipif.exe"
      4⤵
      PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\pjjm4rgna0n.exe
      "C:\Users\Admin\AppData\Local\Temp\pjjm4rgna0n.exe"
      4⤵
      PID:23024
  - - C:\Users\Admin\AppData\Local\Temp\gy1n0hgifz2.exe
      "C:\Users\Admin\AppData\Local\Temp\gy1n0hgifz2.exe"
      4⤵
      PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\sl2f0qprthe.exe
      "C:\Users\Admin\AppData\Local\Temp\sl2f0qprthe.exe"
      4⤵
      PID:29260
  - - C:\Users\Admin\AppData\Local\Temp\rzmuvl1ltwy.exe
      "C:\Users\Admin\AppData\Local\Temp\rzmuvl1ltwy.exe"
      4⤵
      PID:13132
- - C:\Users\Admin\AppData\Local\Temp\xwfh2ppk5dq.exe
    "C:\Users\Admin\AppData\Local\Temp\xwfh2ppk5dq.exe"
    3⤵
    PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\tsphsles2ld.exe
      "C:\Users\Admin\AppData\Local\Temp\tsphsles2ld.exe"
      4⤵
      PID:12864
- - C:\Users\Admin\AppData\Local\Temp\wkx2zfpek0e.exe
    "C:\Users\Admin\AppData\Local\Temp\wkx2zfpek0e.exe"
    3⤵
    PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\vutzoc1kygu.exe
      "C:\Users\Admin\AppData\Local\Temp\vutzoc1kygu.exe"
      4⤵
      PID:32192
- - C:\Users\Admin\AppData\Local\Temp\rh0gygflmu5.exe
    "C:\Users\Admin\AppData\Local\Temp\rh0gygflmu5.exe"
    3⤵
    PID:10892
  - - C:\Users\Admin\AppData\Local\Temp\zeqxioxeegm.exe
      "C:\Users\Admin\AppData\Local\Temp\zeqxioxeegm.exe"
      4⤵
      PID:6340
- - C:\Users\Admin\AppData\Local\Temp\swui3dvhlhi.exe
    "C:\Users\Admin\AppData\Local\Temp\swui3dvhlhi.exe"
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\unhgw40x5xp.exe
    "C:\Users\Admin\AppData\Local\Temp\unhgw40x5xp.exe"
    3⤵
    PID:16160
- - C:\Users\Admin\AppData\Local\Temp\5zfivytj2ox.exe
    "C:\Users\Admin\AppData\Local\Temp\5zfivytj2ox.exe"
    3⤵
    PID:20880
- - C:\Users\Admin\AppData\Local\Temp\gbdyto4b4my.exe
    "C:\Users\Admin\AppData\Local\Temp\gbdyto4b4my.exe"
    3⤵
    PID:26176
- - C:\Users\Admin\AppData\Local\Temp\u20ohdiihvv.exe
    "C:\Users\Admin\AppData\Local\Temp\u20ohdiihvv.exe"
    3⤵
    PID:28380
- - C:\Users\Admin\AppData\Local\Temp\lw1zdvfztgq.exe
    "C:\Users\Admin\AppData\Local\Temp\lw1zdvfztgq.exe"
    3⤵
    PID:32108
- C:\Users\Admin\AppData\Local\Temp\tpg3ymclrw5.exe
  "C:\Users\Admin\AppData\Local\Temp\tpg3ymclrw5.exe"
  2⤵
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\2dxmazbctd5.exe
    "C:\Users\Admin\AppData\Local\Temp\2dxmazbctd5.exe"
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\ypmxn5azt3i.exe
      "C:\Users\Admin\AppData\Local\Temp\ypmxn5azt3i.exe"
      4⤵
      PID:20788
  - - C:\Users\Admin\AppData\Local\Temp\glhq4vczimn.exe
      "C:\Users\Admin\AppData\Local\Temp\glhq4vczimn.exe"
      4⤵
      PID:28612
  - - C:\Users\Admin\AppData\Local\Temp\2ugnsv3lsuy.exe
      "C:\Users\Admin\AppData\Local\Temp\2ugnsv3lsuy.exe"
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\zrkz2jjege3.exe
      "C:\Users\Admin\AppData\Local\Temp\zrkz2jjege3.exe"
      4⤵
      PID:30944
  - - C:\Users\Admin\AppData\Local\Temp\xregoyhkyve.exe
      "C:\Users\Admin\AppData\Local\Temp\xregoyhkyve.exe"
      4⤵
      PID:32636
  - - C:\Users\Admin\AppData\Local\Temp\ofrliu55o4l.exe
      "C:\Users\Admin\AppData\Local\Temp\ofrliu55o4l.exe"
      4⤵
      PID:30852
- - C:\Users\Admin\AppData\Local\Temp\uhujv43y1ka.exe
    "C:\Users\Admin\AppData\Local\Temp\uhujv43y1ka.exe"
    3⤵
    PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\cx04yocgwjt.exe
      "C:\Users\Admin\AppData\Local\Temp\cx04yocgwjt.exe"
      4⤵
      PID:28512
  - - C:\Users\Admin\AppData\Local\Temp\uae3v2ums0x.exe
      "C:\Users\Admin\AppData\Local\Temp\uae3v2ums0x.exe"
      4⤵
      PID:32408
- - C:\Users\Admin\AppData\Local\Temp\qav4flknfko.exe
    "C:\Users\Admin\AppData\Local\Temp\qav4flknfko.exe"
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Local\Temp\ihl5zhore44.exe
    "C:\Users\Admin\AppData\Local\Temp\ihl5zhore44.exe"
    3⤵
    PID:11644
- - C:\Users\Admin\AppData\Local\Temp\0i3b3yffeg2.exe
    "C:\Users\Admin\AppData\Local\Temp\0i3b3yffeg2.exe"
    3⤵
    PID:13328
- - C:\Users\Admin\AppData\Local\Temp\e4ojrltt05b.exe
    "C:\Users\Admin\AppData\Local\Temp\e4ojrltt05b.exe"
    3⤵
    PID:17092
- - C:\Users\Admin\AppData\Local\Temp\pmoa1m3czcf.exe
    "C:\Users\Admin\AppData\Local\Temp\pmoa1m3czcf.exe"
    3⤵
    PID:25900
- - C:\Users\Admin\AppData\Local\Temp\yjro2nzvsmj.exe
    "C:\Users\Admin\AppData\Local\Temp\yjro2nzvsmj.exe"
    3⤵
    PID:9628
- - C:\Users\Admin\AppData\Local\Temp\ullb5x3ywt5.exe
    "C:\Users\Admin\AppData\Local\Temp\ullb5x3ywt5.exe"
    3⤵
    PID:32560
- C:\Users\Admin\AppData\Local\Temp\uso2wjveaew.exe
  "C:\Users\Admin\AppData\Local\Temp\uso2wjveaew.exe"
  2⤵
  PID:580
- - C:\Users\Admin\AppData\Local\Temp\dsnqr14tkdj.exe
    "C:\Users\Admin\AppData\Local\Temp\dsnqr14tkdj.exe"
    3⤵
    PID:13264
- - C:\Users\Admin\AppData\Local\Temp\vow0gdjqyfo.exe
    "C:\Users\Admin\AppData\Local\Temp\vow0gdjqyfo.exe"
    3⤵
    PID:15304
- - C:\Users\Admin\AppData\Local\Temp\ezobnreh3nk.exe
    "C:\Users\Admin\AppData\Local\Temp\ezobnreh3nk.exe"
    3⤵
    PID:23772
- - C:\Users\Admin\AppData\Local\Temp\pvqsevm1ujv.exe
    "C:\Users\Admin\AppData\Local\Temp\pvqsevm1ujv.exe"
    3⤵
    PID:25720
- - C:\Users\Admin\AppData\Local\Temp\bzj5uf402ne.exe
    "C:\Users\Admin\AppData\Local\Temp\bzj5uf402ne.exe"
    3⤵
    PID:20712
- - C:\Users\Admin\AppData\Local\Temp\u4zdwovrhtk.exe
    "C:\Users\Admin\AppData\Local\Temp\u4zdwovrhtk.exe"
    3⤵
    PID:26380
- - C:\Users\Admin\AppData\Local\Temp\1qk4uxmqpm5.exe
    "C:\Users\Admin\AppData\Local\Temp\1qk4uxmqpm5.exe"
    3⤵
    PID:28752
- - C:\Users\Admin\AppData\Local\Temp\pe4dhb4lzw4.exe
    "C:\Users\Admin\AppData\Local\Temp\pe4dhb4lzw4.exe"
    3⤵
    PID:35212
- C:\Users\Admin\AppData\Local\Temp\cmxn143sx5j.exe
  "C:\Users\Admin\AppData\Local\Temp\cmxn143sx5j.exe"
  2⤵
  PID:1216
- - C:\Users\Admin\AppData\Local\Temp\ykolh2a4tri.exe
    "C:\Users\Admin\AppData\Local\Temp\ykolh2a4tri.exe"
    3⤵
    PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\hvzwebjn1o3.exe
      "C:\Users\Admin\AppData\Local\Temp\hvzwebjn1o3.exe"
      4⤵
      PID:34256
- - C:\Users\Admin\AppData\Local\Temp\dsrflbhxpwb.exe
    "C:\Users\Admin\AppData\Local\Temp\dsrflbhxpwb.exe"
    3⤵
    PID:11112
- - C:\Users\Admin\AppData\Local\Temp\osfhv2th4rf.exe
    "C:\Users\Admin\AppData\Local\Temp\osfhv2th4rf.exe"
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\ukbkysmsawp.exe
    "C:\Users\Admin\AppData\Local\Temp\ukbkysmsawp.exe"
    3⤵
    PID:16696
- - C:\Users\Admin\AppData\Local\Temp\gdiyfyegc5q.exe
    "C:\Users\Admin\AppData\Local\Temp\gdiyfyegc5q.exe"
    3⤵
    PID:25352
- - C:\Users\Admin\AppData\Local\Temp\eldrp23f2g4.exe
    "C:\Users\Admin\AppData\Local\Temp\eldrp23f2g4.exe"
    3⤵
    PID:28624
- - C:\Users\Admin\AppData\Local\Temp\ybbpmnqys2w.exe
    "C:\Users\Admin\AppData\Local\Temp\ybbpmnqys2w.exe"
    3⤵
    PID:1984
- C:\Users\Admin\AppData\Local\Temp\pomc25cakkr.exe
  "C:\Users\Admin\AppData\Local\Temp\pomc25cakkr.exe"
  2⤵
  PID:236
- - C:\Users\Admin\AppData\Local\Temp\50poy5oxayu.exe
    "C:\Users\Admin\AppData\Local\Temp\50poy5oxayu.exe"
    3⤵
    PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\jecmky0pa43.exe
      "C:\Users\Admin\AppData\Local\Temp\jecmky0pa43.exe"
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\rfvmju3yze2.exe
      "C:\Users\Admin\AppData\Local\Temp\rfvmju3yze2.exe"
      4⤵
      PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\vbano1noezy.exe
      "C:\Users\Admin\AppData\Local\Temp\vbano1noezy.exe"
      4⤵
      PID:35800
- - C:\Users\Admin\AppData\Local\Temp\4mpmm23hd5e.exe
    "C:\Users\Admin\AppData\Local\Temp\4mpmm23hd5e.exe"
    3⤵
    PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\w1040lb3rmu.exe
      "C:\Users\Admin\AppData\Local\Temp\w1040lb3rmu.exe"
      4⤵
      PID:27436
  - - C:\Users\Admin\AppData\Local\Temp\casmekcxcbr.exe
      "C:\Users\Admin\AppData\Local\Temp\casmekcxcbr.exe"
      4⤵
      PID:32416
- - C:\Users\Admin\AppData\Local\Temp\duptzqaw3sk.exe
    "C:\Users\Admin\AppData\Local\Temp\duptzqaw3sk.exe"
    3⤵
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\0dg5x0xf0kl.exe
      "C:\Users\Admin\AppData\Local\Temp\0dg5x0xf0kl.exe"
      4⤵
      PID:34800
- - C:\Users\Admin\AppData\Local\Temp\hs1zhiorpid.exe
    "C:\Users\Admin\AppData\Local\Temp\hs1zhiorpid.exe"
    3⤵
    PID:6520
- - C:\Users\Admin\AppData\Local\Temp\ylvydjcx1bo.exe
    "C:\Users\Admin\AppData\Local\Temp\ylvydjcx1bo.exe"
    3⤵
    PID:13688
- - C:\Users\Admin\AppData\Local\Temp\m0uhvjy1duf.exe
    "C:\Users\Admin\AppData\Local\Temp\m0uhvjy1duf.exe"
    3⤵
    PID:14500
- - C:\Users\Admin\AppData\Local\Temp\rn3fxikhyj0.exe
    "C:\Users\Admin\AppData\Local\Temp\rn3fxikhyj0.exe"
    3⤵
    PID:22992
- - C:\Users\Admin\AppData\Local\Temp\dfqz0xb5tkl.exe
    "C:\Users\Admin\AppData\Local\Temp\dfqz0xb5tkl.exe"
    3⤵
    PID:25704
- - C:\Users\Admin\AppData\Local\Temp\r05kcx1evxz.exe
    "C:\Users\Admin\AppData\Local\Temp\r05kcx1evxz.exe"
    3⤵
    PID:21692
- - C:\Users\Admin\AppData\Local\Temp\hhmhviciqrr.exe
    "C:\Users\Admin\AppData\Local\Temp\hhmhviciqrr.exe"
    3⤵
    PID:26768
- - C:\Users\Admin\AppData\Local\Temp\ou5dglwonfz.exe
    "C:\Users\Admin\AppData\Local\Temp\ou5dglwonfz.exe"
    3⤵
    PID:30884
- C:\Users\Admin\AppData\Local\Temp\3opjgpveymt.exe
  "C:\Users\Admin\AppData\Local\Temp\3opjgpveymt.exe"
  2⤵
  PID:1068
- - C:\Users\Admin\AppData\Local\Temp\rrmudiix2as.exe
    "C:\Users\Admin\AppData\Local\Temp\rrmudiix2as.exe"
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\0opew4lh3ae.exe
      "C:\Users\Admin\AppData\Local\Temp\0opew4lh3ae.exe"
      4⤵
      PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\fwg3dxrrlr2.exe
      "C:\Users\Admin\AppData\Local\Temp\fwg3dxrrlr2.exe"
      4⤵
      PID:17780
- - C:\Users\Admin\AppData\Local\Temp\dub2ono32w1.exe
    "C:\Users\Admin\AppData\Local\Temp\dub2ono32w1.exe"
    3⤵
    PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\zuwohc3ueqw.exe
      "C:\Users\Admin\AppData\Local\Temp\zuwohc3ueqw.exe"
      4⤵
      PID:32232
- - C:\Users\Admin\AppData\Local\Temp\3ectkw12sd0.exe
    "C:\Users\Admin\AppData\Local\Temp\3ectkw12sd0.exe"
    3⤵
    PID:11088
- - C:\Users\Admin\AppData\Local\Temp\t1qzr2a0ew5.exe
    "C:\Users\Admin\AppData\Local\Temp\t1qzr2a0ew5.exe"
    3⤵
    PID:12968
- - C:\Users\Admin\AppData\Local\Temp\o1xwbgdkc0e.exe
    "C:\Users\Admin\AppData\Local\Temp\o1xwbgdkc0e.exe"
    3⤵
    PID:16176
- - C:\Users\Admin\AppData\Local\Temp\whlqdk3dtea.exe
    "C:\Users\Admin\AppData\Local\Temp\whlqdk3dtea.exe"
    3⤵
    PID:20872
- - C:\Users\Admin\AppData\Local\Temp\kh0b0g2ybdl.exe
    "C:\Users\Admin\AppData\Local\Temp\kh0b0g2ybdl.exe"
    3⤵
    PID:20684
- - C:\Users\Admin\AppData\Local\Temp\05a3akwxqgg.exe
    "C:\Users\Admin\AppData\Local\Temp\05a3akwxqgg.exe"
    3⤵
    PID:25672
- - C:\Users\Admin\AppData\Local\Temp\0wu4qsgzxsr.exe
    "C:\Users\Admin\AppData\Local\Temp\0wu4qsgzxsr.exe"
    3⤵
    PID:27748
- - C:\Users\Admin\AppData\Local\Temp\sid23521y1m.exe
    "C:\Users\Admin\AppData\Local\Temp\sid23521y1m.exe"
    3⤵
    PID:29052
- - C:\Users\Admin\AppData\Local\Temp\qafuenx3irj.exe
    "C:\Users\Admin\AppData\Local\Temp\qafuenx3irj.exe"
    3⤵
    PID:32736
- - C:\Users\Admin\AppData\Local\Temp\zs0ukgrwox1.exe
    "C:\Users\Admin\AppData\Local\Temp\zs0ukgrwox1.exe"
    3⤵
    PID:31860
- - C:\Users\Admin\AppData\Local\Temp\2lzyzdnroiu.exe
    "C:\Users\Admin\AppData\Local\Temp\2lzyzdnroiu.exe"
    3⤵
    PID:34856
- C:\Users\Admin\AppData\Local\Temp\iet35vq0zbj.exe
  "C:\Users\Admin\AppData\Local\Temp\iet35vq0zbj.exe"
  2⤵
  PID:3540
- - C:\Users\Admin\AppData\Local\Temp\ulwhhcany40.exe
    "C:\Users\Admin\AppData\Local\Temp\ulwhhcany40.exe"
    3⤵
    PID:13064
- - C:\Users\Admin\AppData\Local\Temp\3kfliqgbu4n.exe
    "C:\Users\Admin\AppData\Local\Temp\3kfliqgbu4n.exe"
    3⤵
    PID:16152
- - C:\Users\Admin\AppData\Local\Temp\ak41jbfeutf.exe
    "C:\Users\Admin\AppData\Local\Temp\ak41jbfeutf.exe"
    3⤵
    PID:21404
- - C:\Users\Admin\AppData\Local\Temp\22s23d4flo4.exe
    "C:\Users\Admin\AppData\Local\Temp\22s23d4flo4.exe"
    3⤵
    PID:21900
- - C:\Users\Admin\AppData\Local\Temp\uvz5i33bc4x.exe
    "C:\Users\Admin\AppData\Local\Temp\uvz5i33bc4x.exe"
    3⤵
    PID:24172
- - C:\Users\Admin\AppData\Local\Temp\vlzxw13mrds.exe
    "C:\Users\Admin\AppData\Local\Temp\vlzxw13mrds.exe"
    3⤵
    PID:26396
- C:\Users\Admin\AppData\Local\Temp\xdnuhaadi2s.exe
  "C:\Users\Admin\AppData\Local\Temp\xdnuhaadi2s.exe"
  2⤵
  PID:2448
- - C:\Users\Admin\AppData\Local\Temp\bvurpzpokl4.exe
    "C:\Users\Admin\AppData\Local\Temp\bvurpzpokl4.exe"
    3⤵
    PID:11652
- - C:\Users\Admin\AppData\Local\Temp\tmldgzrkrbm.exe
    "C:\Users\Admin\AppData\Local\Temp\tmldgzrkrbm.exe"
    3⤵
    PID:13880
- - C:\Users\Admin\AppData\Local\Temp\2e3hssqc0ic.exe
    "C:\Users\Admin\AppData\Local\Temp\2e3hssqc0ic.exe"
    3⤵
    PID:16768
- - C:\Users\Admin\AppData\Local\Temp\3xyvwywfhci.exe
    "C:\Users\Admin\AppData\Local\Temp\3xyvwywfhci.exe"
    3⤵
    PID:25444
- - C:\Users\Admin\AppData\Local\Temp\bqeam5zzdty.exe
    "C:\Users\Admin\AppData\Local\Temp\bqeam5zzdty.exe"
    3⤵
    PID:24848
- - C:\Users\Admin\AppData\Local\Temp\yk0skmbplju.exe
    "C:\Users\Admin\AppData\Local\Temp\yk0skmbplju.exe"
    3⤵
    PID:29252
- - C:\Users\Admin\AppData\Local\Temp\jbrmc3qccuw.exe
    "C:\Users\Admin\AppData\Local\Temp\jbrmc3qccuw.exe"
    3⤵
    PID:31344
- C:\Users\Admin\AppData\Local\Temp\2l4a23gobzx.exe
  "C:\Users\Admin\AppData\Local\Temp\2l4a23gobzx.exe"
  2⤵
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\mrhqvkqiht5.exe
    "C:\Users\Admin\AppData\Local\Temp\mrhqvkqiht5.exe"
    3⤵
    PID:13500
- - C:\Users\Admin\AppData\Local\Temp\23sbjnqzsfe.exe
    "C:\Users\Admin\AppData\Local\Temp\23sbjnqzsfe.exe"
    3⤵
    PID:16976
- - C:\Users\Admin\AppData\Local\Temp\jk1ymbi31hk.exe
    "C:\Users\Admin\AppData\Local\Temp\jk1ymbi31hk.exe"
    3⤵
    PID:3208
- - C:\Users\Admin\AppData\Local\Temp\aupc0wn0cqa.exe
    "C:\Users\Admin\AppData\Local\Temp\aupc0wn0cqa.exe"
    3⤵
    PID:20236
- - C:\Users\Admin\AppData\Local\Temp\5bkka2en34x.exe
    "C:\Users\Admin\AppData\Local\Temp\5bkka2en34x.exe"
    3⤵
    PID:23228
- - C:\Users\Admin\AppData\Local\Temp\x3dfoztiqu2.exe
    "C:\Users\Admin\AppData\Local\Temp\x3dfoztiqu2.exe"
    3⤵
    PID:14388
- - C:\Users\Admin\AppData\Local\Temp\23aylxqcqlu.exe
    "C:\Users\Admin\AppData\Local\Temp\23aylxqcqlu.exe"
    3⤵
    PID:28080
- - C:\Users\Admin\AppData\Local\Temp\3b3jjli4gez.exe
    "C:\Users\Admin\AppData\Local\Temp\3b3jjli4gez.exe"
    3⤵
    PID:27812
- C:\Users\Admin\AppData\Local\Temp\h1bfb2ccl2i.exe
  "C:\Users\Admin\AppData\Local\Temp\h1bfb2ccl2i.exe"
  2⤵
  PID:3988
- - C:\Users\Admin\AppData\Local\Temp\m2yrzcwdw24.exe
    "C:\Users\Admin\AppData\Local\Temp\m2yrzcwdw24.exe"
    3⤵
    PID:8460
- - C:\Users\Admin\AppData\Local\Temp\nnvcfyk3wdi.exe
    "C:\Users\Admin\AppData\Local\Temp\nnvcfyk3wdi.exe"
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\mdzkc0daxzb.exe
    "C:\Users\Admin\AppData\Local\Temp\mdzkc0daxzb.exe"
    3⤵
    PID:14872
- - C:\Users\Admin\AppData\Local\Temp\q0p3khyrshg.exe
    "C:\Users\Admin\AppData\Local\Temp\q0p3khyrshg.exe"
    3⤵
    PID:18444
- - C:\Users\Admin\AppData\Local\Temp\2mnf3alc3kd.exe
    "C:\Users\Admin\AppData\Local\Temp\2mnf3alc3kd.exe"
    3⤵
    PID:19676
- - C:\Users\Admin\AppData\Local\Temp\z3os1h2akit.exe
    "C:\Users\Admin\AppData\Local\Temp\z3os1h2akit.exe"
    3⤵
    PID:23544
- - C:\Users\Admin\AppData\Local\Temp\acmm4vk2sbp.exe
    "C:\Users\Admin\AppData\Local\Temp\acmm4vk2sbp.exe"
    3⤵
    PID:20960
- - C:\Users\Admin\AppData\Local\Temp\xodjn14crho.exe
    "C:\Users\Admin\AppData\Local\Temp\xodjn14crho.exe"
    3⤵
    PID:27452
- - C:\Users\Admin\AppData\Local\Temp\c3wlkc20r1q.exe
    "C:\Users\Admin\AppData\Local\Temp\c3wlkc20r1q.exe"
    3⤵
    PID:27196
- - C:\Users\Admin\AppData\Local\Temp\21jmczxhk15.exe
    "C:\Users\Admin\AppData\Local\Temp\21jmczxhk15.exe"
    3⤵
    PID:28736
- C:\Users\Admin\AppData\Local\Temp\jujbkvzqnoq.exe
  "C:\Users\Admin\AppData\Local\Temp\jujbkvzqnoq.exe"
  2⤵
  PID:3336
- - C:\Users\Admin\AppData\Local\Temp\ke3a5cuz4cs.exe
    "C:\Users\Admin\AppData\Local\Temp\ke3a5cuz4cs.exe"
    3⤵
    PID:6644
- - C:\Users\Admin\AppData\Local\Temp\tyq2efzgwlo.exe
    "C:\Users\Admin\AppData\Local\Temp\tyq2efzgwlo.exe"
    3⤵
    PID:13704
- - C:\Users\Admin\AppData\Local\Temp\ddo2r1ykbj5.exe
    "C:\Users\Admin\AppData\Local\Temp\ddo2r1ykbj5.exe"
    3⤵
    PID:16688
- - C:\Users\Admin\AppData\Local\Temp\czwplsifltb.exe
    "C:\Users\Admin\AppData\Local\Temp\czwplsifltb.exe"
    3⤵
    PID:25944
- - C:\Users\Admin\AppData\Local\Temp\qjxewukkygr.exe
    "C:\Users\Admin\AppData\Local\Temp\qjxewukkygr.exe"
    3⤵
    PID:25256
- - C:\Users\Admin\AppData\Local\Temp\1x1aiybrxol.exe
    "C:\Users\Admin\AppData\Local\Temp\1x1aiybrxol.exe"
    3⤵
    PID:27856
- C:\Users\Admin\AppData\Local\Temp\zsmjbw4wc4j.exe
  "C:\Users\Admin\AppData\Local\Temp\zsmjbw4wc4j.exe"
  2⤵
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\zdwgmdf5bm1.exe
    "C:\Users\Admin\AppData\Local\Temp\zdwgmdf5bm1.exe"
    3⤵
    PID:3396
- - C:\Users\Admin\AppData\Local\Temp\0upiu34wbor.exe
    "C:\Users\Admin\AppData\Local\Temp\0upiu34wbor.exe"
    3⤵
    PID:16880
- - C:\Users\Admin\AppData\Local\Temp\jbsspk5fd5g.exe
    "C:\Users\Admin\AppData\Local\Temp\jbsspk5fd5g.exe"
    3⤵
    PID:17364
- - C:\Users\Admin\AppData\Local\Temp\t1kssfdospl.exe
    "C:\Users\Admin\AppData\Local\Temp\t1kssfdospl.exe"
    3⤵
    PID:19316
- - C:\Users\Admin\AppData\Local\Temp\0hzokbdyhaz.exe
    "C:\Users\Admin\AppData\Local\Temp\0hzokbdyhaz.exe"
    3⤵
    PID:23256
- - C:\Users\Admin\AppData\Local\Temp\qyxcfhmpm5r.exe
    "C:\Users\Admin\AppData\Local\Temp\qyxcfhmpm5r.exe"
    3⤵
    PID:23792
- - C:\Users\Admin\AppData\Local\Temp\gbjjwaihr3q.exe
    "C:\Users\Admin\AppData\Local\Temp\gbjjwaihr3q.exe"
    3⤵
    PID:27060
- - C:\Users\Admin\AppData\Local\Temp\w0zzvikmgnr.exe
    "C:\Users\Admin\AppData\Local\Temp\w0zzvikmgnr.exe"
    3⤵
    PID:26608
- - C:\Users\Admin\AppData\Local\Temp\jitzjp353cq.exe
    "C:\Users\Admin\AppData\Local\Temp\jitzjp353cq.exe"
    3⤵
    PID:8964
- - C:\Users\Admin\AppData\Local\Temp\x10eknc0epn.exe
    "C:\Users\Admin\AppData\Local\Temp\x10eknc0epn.exe"
    3⤵
    PID:12140
- - C:\Users\Admin\AppData\Local\Temp\45lrglcaymu.exe
    "C:\Users\Admin\AppData\Local\Temp\45lrglcaymu.exe"
    3⤵
    PID:35400
- C:\Users\Admin\AppData\Local\Temp\pzyedjbegi0.exe
  "C:\Users\Admin\AppData\Local\Temp\pzyedjbegi0.exe"
  2⤵
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\nonzrbxnic1.exe
    "C:\Users\Admin\AppData\Local\Temp\nonzrbxnic1.exe"
    3⤵
    PID:2988
  - - C:\Users\Admin\AppData\Local\Temp\dm3hhjsbnai.exe
      "C:\Users\Admin\AppData\Local\Temp\dm3hhjsbnai.exe"
      4⤵
      PID:25652
  - - C:\Users\Admin\AppData\Local\Temp\1dyuu3xhvw0.exe
      "C:\Users\Admin\AppData\Local\Temp\1dyuu3xhvw0.exe"
      4⤵
      PID:30012
  - - C:\Users\Admin\AppData\Local\Temp\qyuru5jl4bb.exe
      "C:\Users\Admin\AppData\Local\Temp\qyuru5jl4bb.exe"
      4⤵
      PID:14924
- - C:\Users\Admin\AppData\Local\Temp\y1lgldhmfzj.exe
    "C:\Users\Admin\AppData\Local\Temp\y1lgldhmfzj.exe"
    3⤵
    PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\msxgfnujrbe.exe
      "C:\Users\Admin\AppData\Local\Temp\msxgfnujrbe.exe"
      4⤵
      PID:26124
  - - C:\Users\Admin\AppData\Local\Temp\cgrsnqgdfsc.exe
      "C:\Users\Admin\AppData\Local\Temp\cgrsnqgdfsc.exe"
      4⤵
      PID:32596
- - C:\Users\Admin\AppData\Local\Temp\cj3ae5l4myx.exe
    "C:\Users\Admin\AppData\Local\Temp\cj3ae5l4myx.exe"
    3⤵
    PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\5bmugrdf1jr.exe
      "C:\Users\Admin\AppData\Local\Temp\5bmugrdf1jr.exe"
      4⤵
      PID:33160
- - C:\Users\Admin\AppData\Local\Temp\zcqjze2iexc.exe
    "C:\Users\Admin\AppData\Local\Temp\zcqjze2iexc.exe"
    3⤵
    PID:11820
- - C:\Users\Admin\AppData\Local\Temp\fp4faqf0lgk.exe
    "C:\Users\Admin\AppData\Local\Temp\fp4faqf0lgk.exe"
    3⤵
    PID:9284
- - C:\Users\Admin\AppData\Local\Temp\hrate1dd2mm.exe
    "C:\Users\Admin\AppData\Local\Temp\hrate1dd2mm.exe"
    3⤵
    PID:14324
- - C:\Users\Admin\AppData\Local\Temp\gcf0bmwlwoz.exe
    "C:\Users\Admin\AppData\Local\Temp\gcf0bmwlwoz.exe"
    3⤵
    PID:18456
- - C:\Users\Admin\AppData\Local\Temp\0mx3f3gjg5k.exe
    "C:\Users\Admin\AppData\Local\Temp\0mx3f3gjg5k.exe"
    3⤵
    PID:19732
- - C:\Users\Admin\AppData\Local\Temp\amonhhwp3x5.exe
    "C:\Users\Admin\AppData\Local\Temp\amonhhwp3x5.exe"
    3⤵
    PID:19660
- - C:\Users\Admin\AppData\Local\Temp\4n5c3hevgp0.exe
    "C:\Users\Admin\AppData\Local\Temp\4n5c3hevgp0.exe"
    3⤵
    PID:21740
- - C:\Users\Admin\AppData\Local\Temp\nhjjgxe1yh3.exe
    "C:\Users\Admin\AppData\Local\Temp\nhjjgxe1yh3.exe"
    3⤵
    PID:29556
- - C:\Users\Admin\AppData\Local\Temp\yjkz3xjc4xm.exe
    "C:\Users\Admin\AppData\Local\Temp\yjkz3xjc4xm.exe"
    3⤵
    PID:31488
- C:\Users\Admin\AppData\Local\Temp\rwaqbjl5enk.exe
  "C:\Users\Admin\AppData\Local\Temp\rwaqbjl5enk.exe"
  2⤵
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\j5nsc4a0ggh.exe
    "C:\Users\Admin\AppData\Local\Temp\j5nsc4a0ggh.exe"
    3⤵
    PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\tfn0j0grjdi.exe
      "C:\Users\Admin\AppData\Local\Temp\tfn0j0grjdi.exe"
      4⤵
      PID:26052
  - - C:\Users\Admin\AppData\Local\Temp\dbkrd12inqr.exe
      "C:\Users\Admin\AppData\Local\Temp\dbkrd12inqr.exe"
      4⤵
      PID:26144
  - - C:\Users\Admin\AppData\Local\Temp\sugrlg1rx30.exe
      "C:\Users\Admin\AppData\Local\Temp\sugrlg1rx30.exe"
      4⤵
      PID:24644
- - C:\Users\Admin\AppData\Local\Temp\uvmsgukqtag.exe
    "C:\Users\Admin\AppData\Local\Temp\uvmsgukqtag.exe"
    3⤵
    PID:9868
- - C:\Users\Admin\AppData\Local\Temp\niymqijyobp.exe
    "C:\Users\Admin\AppData\Local\Temp\niymqijyobp.exe"
    3⤵
    PID:13304
- - C:\Users\Admin\AppData\Local\Temp\dfenfcghrw4.exe
    "C:\Users\Admin\AppData\Local\Temp\dfenfcghrw4.exe"
    3⤵
    PID:15368
- - C:\Users\Admin\AppData\Local\Temp\f1bfzquonif.exe
    "C:\Users\Admin\AppData\Local\Temp\f1bfzquonif.exe"
    3⤵
    PID:22984
- - C:\Users\Admin\AppData\Local\Temp\a30wxlbrrbu.exe
    "C:\Users\Admin\AppData\Local\Temp\a30wxlbrrbu.exe"
    3⤵
    PID:24232
- - C:\Users\Admin\AppData\Local\Temp\2wsvy3nbmjp.exe
    "C:\Users\Admin\AppData\Local\Temp\2wsvy3nbmjp.exe"
    3⤵
    PID:26804
- - C:\Users\Admin\AppData\Local\Temp\gonpz12efzs.exe
    "C:\Users\Admin\AppData\Local\Temp\gonpz12efzs.exe"
    3⤵
    PID:28352
- - C:\Users\Admin\AppData\Local\Temp\3cr4huuwuvw.exe
    "C:\Users\Admin\AppData\Local\Temp\3cr4huuwuvw.exe"
    3⤵
    PID:27588
- - C:\Users\Admin\AppData\Local\Temp\g1xt4cizcl4.exe
    "C:\Users\Admin\AppData\Local\Temp\g1xt4cizcl4.exe"
    3⤵
    PID:24272
- C:\Users\Admin\AppData\Local\Temp\tobbuvcv5dy.exe
  "C:\Users\Admin\AppData\Local\Temp\tobbuvcv5dy.exe"
  2⤵
  PID:4736
- - C:\Users\Admin\AppData\Local\Temp\1qa3lxt3g22.exe
    "C:\Users\Admin\AppData\Local\Temp\1qa3lxt3g22.exe"
    3⤵
    PID:11972
- - C:\Users\Admin\AppData\Local\Temp\51d5dvgyvuo.exe
    "C:\Users\Admin\AppData\Local\Temp\51d5dvgyvuo.exe"
    3⤵
    PID:13560
- - C:\Users\Admin\AppData\Local\Temp\mll1xupstpr.exe
    "C:\Users\Admin\AppData\Local\Temp\mll1xupstpr.exe"
    3⤵
    PID:14376
- - C:\Users\Admin\AppData\Local\Temp\tqo33tnh04j.exe
    "C:\Users\Admin\AppData\Local\Temp\tqo33tnh04j.exe"
    3⤵
    PID:18484
- - C:\Users\Admin\AppData\Local\Temp\wkxqh3vpkms.exe
    "C:\Users\Admin\AppData\Local\Temp\wkxqh3vpkms.exe"
    3⤵
    PID:19744
- - C:\Users\Admin\AppData\Local\Temp\a4dmhnygn4m.exe
    "C:\Users\Admin\AppData\Local\Temp\a4dmhnygn4m.exe"
    3⤵
    PID:23644
- - C:\Users\Admin\AppData\Local\Temp\kovokxwjdck.exe
    "C:\Users\Admin\AppData\Local\Temp\kovokxwjdck.exe"
    3⤵
    PID:7136
- - C:\Users\Admin\AppData\Local\Temp\12pd54scldy.exe
    "C:\Users\Admin\AppData\Local\Temp\12pd54scldy.exe"
    3⤵
    PID:29412
- - C:\Users\Admin\AppData\Local\Temp\jdk5cpbfnqx.exe
    "C:\Users\Admin\AppData\Local\Temp\jdk5cpbfnqx.exe"
    3⤵
    PID:8124
- C:\Users\Admin\AppData\Local\Temp\n0drnzv0ppq.exe
  "C:\Users\Admin\AppData\Local\Temp\n0drnzv0ppq.exe"
  2⤵
  PID:4236
- - C:\Users\Admin\AppData\Local\Temp\tyt5bkosntx.exe
    "C:\Users\Admin\AppData\Local\Temp\tyt5bkosntx.exe"
    3⤵
    PID:13156
- - C:\Users\Admin\AppData\Local\Temp\uwu2234upfs.exe
    "C:\Users\Admin\AppData\Local\Temp\uwu2234upfs.exe"
    3⤵
    PID:16200
- - C:\Users\Admin\AppData\Local\Temp\1r1ugntxzfk.exe
    "C:\Users\Admin\AppData\Local\Temp\1r1ugntxzfk.exe"
    3⤵
    PID:21364
- - C:\Users\Admin\AppData\Local\Temp\utku4srtlc2.exe
    "C:\Users\Admin\AppData\Local\Temp\utku4srtlc2.exe"
    3⤵
    PID:21624
- - C:\Users\Admin\AppData\Local\Temp\5lfeboe11mj.exe
    "C:\Users\Admin\AppData\Local\Temp\5lfeboe11mj.exe"
    3⤵
    PID:22388
- - C:\Users\Admin\AppData\Local\Temp\f1gujxu14hy.exe
    "C:\Users\Admin\AppData\Local\Temp\f1gujxu14hy.exe"
    3⤵
    PID:28420
- - C:\Users\Admin\AppData\Local\Temp\1wfxe34fcho.exe
    "C:\Users\Admin\AppData\Local\Temp\1wfxe34fcho.exe"
    3⤵
    PID:5524
- - C:\Users\Admin\AppData\Local\Temp\gikj0ollabe.exe
    "C:\Users\Admin\AppData\Local\Temp\gikj0ollabe.exe"
    3⤵
    PID:14192
- C:\Users\Admin\AppData\Local\Temp\gmybau2hfju.exe
  "C:\Users\Admin\AppData\Local\Temp\gmybau2hfju.exe"
  2⤵
  PID:4180
- - C:\Users\Admin\AppData\Local\Temp\2goyecur0rg.exe
    "C:\Users\Admin\AppData\Local\Temp\2goyecur0rg.exe"
    3⤵
    PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\lrplcbrazxq.exe
      "C:\Users\Admin\AppData\Local\Temp\lrplcbrazxq.exe"
      4⤵
      PID:10864
- - C:\Users\Admin\AppData\Local\Temp\0fgugfyy0fl.exe
    "C:\Users\Admin\AppData\Local\Temp\0fgugfyy0fl.exe"
    3⤵
    PID:1632
- - C:\Users\Admin\AppData\Local\Temp\tk3hpqtogbn.exe
    "C:\Users\Admin\AppData\Local\Temp\tk3hpqtogbn.exe"
    3⤵
    PID:15044
- - C:\Users\Admin\AppData\Local\Temp\wplvun13ide.exe
    "C:\Users\Admin\AppData\Local\Temp\wplvun13ide.exe"
    3⤵
    PID:15948
- - C:\Users\Admin\AppData\Local\Temp\jvm5sx2tqcw.exe
    "C:\Users\Admin\AppData\Local\Temp\jvm5sx2tqcw.exe"
    3⤵
    PID:20956
- - C:\Users\Admin\AppData\Local\Temp\kjuqmoebxly.exe
    "C:\Users\Admin\AppData\Local\Temp\kjuqmoebxly.exe"
    3⤵
    PID:20000
- - C:\Users\Admin\AppData\Local\Temp\4x3nfil1gvp.exe
    "C:\Users\Admin\AppData\Local\Temp\4x3nfil1gvp.exe"
    3⤵
    PID:25624
- - C:\Users\Admin\AppData\Local\Temp\1a3xe1xepmp.exe
    "C:\Users\Admin\AppData\Local\Temp\1a3xe1xepmp.exe"
    3⤵
    PID:24740
- - C:\Users\Admin\AppData\Local\Temp\akgrbru4rvf.exe
    "C:\Users\Admin\AppData\Local\Temp\akgrbru4rvf.exe"
    3⤵
    PID:29928
- C:\Users\Admin\AppData\Local\Temp\xc4xrmz3vk3.exe
  "C:\Users\Admin\AppData\Local\Temp\xc4xrmz3vk3.exe"
  2⤵
  PID:4920
- - C:\Users\Admin\AppData\Local\Temp\bodsdmorhil.exe
    "C:\Users\Admin\AppData\Local\Temp\bodsdmorhil.exe"
    3⤵
    PID:13448
- - C:\Users\Admin\AppData\Local\Temp\rshn45zsd3y.exe
    "C:\Users\Admin\AppData\Local\Temp\rshn45zsd3y.exe"
    3⤵
    PID:17344
- - C:\Users\Admin\AppData\Local\Temp\afoiuiquhdo.exe
    "C:\Users\Admin\AppData\Local\Temp\afoiuiquhdo.exe"
    3⤵
    PID:17376
- - C:\Users\Admin\AppData\Local\Temp\vane33m2b05.exe
    "C:\Users\Admin\AppData\Local\Temp\vane33m2b05.exe"
    3⤵
    PID:19396
- - C:\Users\Admin\AppData\Local\Temp\yptdtc01r3g.exe
    "C:\Users\Admin\AppData\Local\Temp\yptdtc01r3g.exe"
    3⤵
    PID:23360
- - C:\Users\Admin\AppData\Local\Temp\xy3boazzjaj.exe
    "C:\Users\Admin\AppData\Local\Temp\xy3boazzjaj.exe"
    3⤵
    PID:22216
- - C:\Users\Admin\AppData\Local\Temp\xjt24p1x0yf.exe
    "C:\Users\Admin\AppData\Local\Temp\xjt24p1x0yf.exe"
    3⤵
    PID:28412
- - C:\Users\Admin\AppData\Local\Temp\mafxm52hfea.exe
    "C:\Users\Admin\AppData\Local\Temp\mafxm52hfea.exe"
    3⤵
    PID:28980
- - C:\Users\Admin\AppData\Local\Temp\zxq0lreqjbg.exe
    "C:\Users\Admin\AppData\Local\Temp\zxq0lreqjbg.exe"
    3⤵
    PID:26348
- C:\Users\Admin\AppData\Local\Temp\rulg5rpibqu.exe
  "C:\Users\Admin\AppData\Local\Temp\rulg5rpibqu.exe"
  2⤵
  PID:5024
- - C:\Users\Admin\AppData\Local\Temp\amldzmskqdo.exe
    "C:\Users\Admin\AppData\Local\Temp\amldzmskqdo.exe"
    3⤵
    PID:13428
- - C:\Users\Admin\AppData\Local\Temp\wclgleorwec.exe
    "C:\Users\Admin\AppData\Local\Temp\wclgleorwec.exe"
    3⤵
    PID:4468
- - C:\Users\Admin\AppData\Local\Temp\s0zu1h0n1hj.exe
    "C:\Users\Admin\AppData\Local\Temp\s0zu1h0n1hj.exe"
    3⤵
    PID:25988
- - C:\Users\Admin\AppData\Local\Temp\gwc5zt55gle.exe
    "C:\Users\Admin\AppData\Local\Temp\gwc5zt55gle.exe"
    3⤵
    PID:25472
- - C:\Users\Admin\AppData\Local\Temp\3yybdpu32cx.exe
    "C:\Users\Admin\AppData\Local\Temp\3yybdpu32cx.exe"
    3⤵
    PID:32036
- C:\Users\Admin\AppData\Local\Temp\memzmzh0rjv.exe
  "C:\Users\Admin\AppData\Local\Temp\memzmzh0rjv.exe"
  2⤵
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\0ttph2hkoka.exe
    "C:\Users\Admin\AppData\Local\Temp\0ttph2hkoka.exe"
    3⤵
    PID:11376
- - C:\Users\Admin\AppData\Local\Temp\liak4npovnz.exe
    "C:\Users\Admin\AppData\Local\Temp\liak4npovnz.exe"
    3⤵
    PID:14076
- - C:\Users\Admin\AppData\Local\Temp\mrflzcvar1q.exe
    "C:\Users\Admin\AppData\Local\Temp\mrflzcvar1q.exe"
    3⤵
    PID:16760
- - C:\Users\Admin\AppData\Local\Temp\tte4bvckmk4.exe
    "C:\Users\Admin\AppData\Local\Temp\tte4bvckmk4.exe"
    3⤵
    PID:17008
- - C:\Users\Admin\AppData\Local\Temp\yzctb4jgna1.exe
    "C:\Users\Admin\AppData\Local\Temp\yzctb4jgna1.exe"
    3⤵
    PID:18996
- - C:\Users\Admin\AppData\Local\Temp\ueiz4lr533j.exe
    "C:\Users\Admin\AppData\Local\Temp\ueiz4lr533j.exe"
    3⤵
    PID:24028
- - C:\Users\Admin\AppData\Local\Temp\mdifl0nifpb.exe
    "C:\Users\Admin\AppData\Local\Temp\mdifl0nifpb.exe"
    3⤵
    PID:26064
- - C:\Users\Admin\AppData\Local\Temp\dnlv3vibegc.exe
    "C:\Users\Admin\AppData\Local\Temp\dnlv3vibegc.exe"
    3⤵
    PID:11468
- - C:\Users\Admin\AppData\Local\Temp\1adexo4cnqw.exe
    "C:\Users\Admin\AppData\Local\Temp\1adexo4cnqw.exe"
    3⤵
    PID:31104
- C:\Users\Admin\AppData\Local\Temp\ndkjzda5rsg.exe
  "C:\Users\Admin\AppData\Local\Temp\ndkjzda5rsg.exe"
  2⤵
  PID:4576
- - C:\Users\Admin\AppData\Local\Temp\hjbxkq5r3mi.exe
    "C:\Users\Admin\AppData\Local\Temp\hjbxkq5r3mi.exe"
    3⤵
    PID:11920
- - C:\Users\Admin\AppData\Local\Temp\wgoei02rl5x.exe
    "C:\Users\Admin\AppData\Local\Temp\wgoei02rl5x.exe"
    3⤵
    PID:14252
- - C:\Users\Admin\AppData\Local\Temp\u5stv3u5y5t.exe
    "C:\Users\Admin\AppData\Local\Temp\u5stv3u5y5t.exe"
    3⤵
    PID:14992
- - C:\Users\Admin\AppData\Local\Temp\c3cqhfnfpvh.exe
    "C:\Users\Admin\AppData\Local\Temp\c3cqhfnfpvh.exe"
    3⤵
    PID:18492
- - C:\Users\Admin\AppData\Local\Temp\cobbsoygflp.exe
    "C:\Users\Admin\AppData\Local\Temp\cobbsoygflp.exe"
    3⤵
    PID:18860
- - C:\Users\Admin\AppData\Local\Temp\fps0ckd4eii.exe
    "C:\Users\Admin\AppData\Local\Temp\fps0ckd4eii.exe"
    3⤵
    PID:24820
- - C:\Users\Admin\AppData\Local\Temp\wp5xyswvw04.exe
    "C:\Users\Admin\AppData\Local\Temp\wp5xyswvw04.exe"
    3⤵
    PID:21952
- - C:\Users\Admin\AppData\Local\Temp\kqflm4xadmw.exe
    "C:\Users\Admin\AppData\Local\Temp\kqflm4xadmw.exe"
    3⤵
    PID:28848
- - C:\Users\Admin\AppData\Local\Temp\u4qt1e3pqrb.exe
    "C:\Users\Admin\AppData\Local\Temp\u4qt1e3pqrb.exe"
    3⤵
    PID:3844
- C:\Users\Admin\AppData\Local\Temp\l0davhjgccc.exe
  "C:\Users\Admin\AppData\Local\Temp\l0davhjgccc.exe"
  2⤵
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\nfhngckkiyc.exe
    "C:\Users\Admin\AppData\Local\Temp\nfhngckkiyc.exe"
    3⤵
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\zmpibwfvbly.exe
      "C:\Users\Admin\AppData\Local\Temp\zmpibwfvbly.exe"
      4⤵
      PID:24252
  - - C:\Users\Admin\AppData\Local\Temp\uggqqi5anvm.exe
      "C:\Users\Admin\AppData\Local\Temp\uggqqi5anvm.exe"
      4⤵
      PID:29636
  - - C:\Users\Admin\AppData\Local\Temp\nspkzlhnxs4.exe
      "C:\Users\Admin\AppData\Local\Temp\nspkzlhnxs4.exe"
      4⤵
      PID:31472
- - C:\Users\Admin\AppData\Local\Temp\rjiqbt22vle.exe
    "C:\Users\Admin\AppData\Local\Temp\rjiqbt22vle.exe"
    3⤵
    PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\ekw3ze5xjrj.exe
      "C:\Users\Admin\AppData\Local\Temp\ekw3ze5xjrj.exe"
      4⤵
      PID:26084
  - - C:\Users\Admin\AppData\Local\Temp\a4dzpkikvkx.exe
      "C:\Users\Admin\AppData\Local\Temp\a4dzpkikvkx.exe"
      4⤵
      PID:25528
  - - C:\Users\Admin\AppData\Local\Temp\qwawnwfbmap.exe
      "C:\Users\Admin\AppData\Local\Temp\qwawnwfbmap.exe"
      4⤵
      PID:26256
- - C:\Users\Admin\AppData\Local\Temp\0ooc3x2bgii.exe
    "C:\Users\Admin\AppData\Local\Temp\0ooc3x2bgii.exe"
    3⤵
    PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\bz0ihu1edmo.exe
      "C:\Users\Admin\AppData\Local\Temp\bz0ihu1edmo.exe"
      4⤵
      PID:34756
- - C:\Users\Admin\AppData\Local\Temp\zb1fa0zu3kh.exe
    "C:\Users\Admin\AppData\Local\Temp\zb1fa0zu3kh.exe"
    3⤵
    PID:12200
- - C:\Users\Admin\AppData\Local\Temp\mcplomiuxdo.exe
    "C:\Users\Admin\AppData\Local\Temp\mcplomiuxdo.exe"
    3⤵
    PID:14096
- - C:\Users\Admin\AppData\Local\Temp\gmlyxe3wvzl.exe
    "C:\Users\Admin\AppData\Local\Temp\gmlyxe3wvzl.exe"
    3⤵
    PID:10228
- - C:\Users\Admin\AppData\Local\Temp\3idfrj3pgrd.exe
    "C:\Users\Admin\AppData\Local\Temp\3idfrj3pgrd.exe"
    3⤵
    PID:5968
- - C:\Users\Admin\AppData\Local\Temp\gi4qri2z02e.exe
    "C:\Users\Admin\AppData\Local\Temp\gi4qri2z02e.exe"
    3⤵
    PID:20616
- - C:\Users\Admin\AppData\Local\Temp\m2jsjvuzong.exe
    "C:\Users\Admin\AppData\Local\Temp\m2jsjvuzong.exe"
    3⤵
    PID:22960
- - C:\Users\Admin\AppData\Local\Temp\as3dopqyolk.exe
    "C:\Users\Admin\AppData\Local\Temp\as3dopqyolk.exe"
    3⤵
    PID:21860
- - C:\Users\Admin\AppData\Local\Temp\vwvgv1tle0x.exe
    "C:\Users\Admin\AppData\Local\Temp\vwvgv1tle0x.exe"
    3⤵
    PID:8852
- - C:\Users\Admin\AppData\Local\Temp\4j2myl5mhr0.exe
    "C:\Users\Admin\AppData\Local\Temp\4j2myl5mhr0.exe"
    3⤵
    PID:32152
- - C:\Users\Admin\AppData\Local\Temp\tfyvpai33la.exe
    "C:\Users\Admin\AppData\Local\Temp\tfyvpai33la.exe"
    3⤵
    PID:33852
- C:\Users\Admin\AppData\Local\Temp\aghpwyfioll.exe
  "C:\Users\Admin\AppData\Local\Temp\aghpwyfioll.exe"
  2⤵
  PID:572
- - C:\Users\Admin\AppData\Local\Temp\wlpu4hu0s0x.exe
    "C:\Users\Admin\AppData\Local\Temp\wlpu4hu0s0x.exe"
    3⤵
    PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\flq3alwvd1v.exe
      "C:\Users\Admin\AppData\Local\Temp\flq3alwvd1v.exe"
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\iu3wso1pgdd.exe
      "C:\Users\Admin\AppData\Local\Temp\iu3wso1pgdd.exe"
      4⤵
      PID:29344
- - C:\Users\Admin\AppData\Local\Temp\eiejyflpjpu.exe
    "C:\Users\Admin\AppData\Local\Temp\eiejyflpjpu.exe"
    3⤵
    PID:3556
- - C:\Users\Admin\AppData\Local\Temp\ovxhntk1i52.exe
    "C:\Users\Admin\AppData\Local\Temp\ovxhntk1i52.exe"
    3⤵
    PID:13244
- - C:\Users\Admin\AppData\Local\Temp\0rj1yt0f3th.exe
    "C:\Users\Admin\AppData\Local\Temp\0rj1yt0f3th.exe"
    3⤵
    PID:16192
- - C:\Users\Admin\AppData\Local\Temp\lwael3o5d2b.exe
    "C:\Users\Admin\AppData\Local\Temp\lwael3o5d2b.exe"
    3⤵
    PID:21372
- - C:\Users\Admin\AppData\Local\Temp\mkeekxwjpom.exe
    "C:\Users\Admin\AppData\Local\Temp\mkeekxwjpom.exe"
    3⤵
    PID:21736
- - C:\Users\Admin\AppData\Local\Temp\0hyjevwhwxh.exe
    "C:\Users\Admin\AppData\Local\Temp\0hyjevwhwxh.exe"
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\tino1ubijld.exe
    "C:\Users\Admin\AppData\Local\Temp\tino1ubijld.exe"
    3⤵
    PID:25112
- - C:\Users\Admin\AppData\Local\Temp\zs4au2ze4si.exe
    "C:\Users\Admin\AppData\Local\Temp\zs4au2ze4si.exe"
    3⤵
    PID:28708
- - C:\Users\Admin\AppData\Local\Temp\amoj20fo0sa.exe
    "C:\Users\Admin\AppData\Local\Temp\amoj20fo0sa.exe"
    3⤵
    PID:30056
- C:\Users\Admin\AppData\Local\Temp\drpuuww2z40.exe
  "C:\Users\Admin\AppData\Local\Temp\drpuuww2z40.exe"
  2⤵
  PID:900
- - C:\Users\Admin\AppData\Local\Temp\2vvoldb0pcz.exe
    "C:\Users\Admin\AppData\Local\Temp\2vvoldb0pcz.exe"
    3⤵
    PID:13184
- - C:\Users\Admin\AppData\Local\Temp\czxggg1brpd.exe
    "C:\Users\Admin\AppData\Local\Temp\czxggg1brpd.exe"
    3⤵
    PID:16608
- - C:\Users\Admin\AppData\Local\Temp\d2qt13s0bg1.exe
    "C:\Users\Admin\AppData\Local\Temp\d2qt13s0bg1.exe"
    3⤵
    PID:24416
- - C:\Users\Admin\AppData\Local\Temp\gmaxg4q34in.exe
    "C:\Users\Admin\AppData\Local\Temp\gmaxg4q34in.exe"
    3⤵
    PID:21100
- - C:\Users\Admin\AppData\Local\Temp\02c3qnbjl3b.exe
    "C:\Users\Admin\AppData\Local\Temp\02c3qnbjl3b.exe"
    3⤵
    PID:26012
- C:\Users\Admin\AppData\Local\Temp\kfyrzywxmha.exe
  "C:\Users\Admin\AppData\Local\Temp\kfyrzywxmha.exe"
  2⤵
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\kx05twvqwhe.exe
    "C:\Users\Admin\AppData\Local\Temp\kx05twvqwhe.exe"
    3⤵
    PID:11812
- - C:\Users\Admin\AppData\Local\Temp\qpalcgawcsa.exe
    "C:\Users\Admin\AppData\Local\Temp\qpalcgawcsa.exe"
    3⤵
    PID:15060
- - C:\Users\Admin\AppData\Local\Temp\k5dj2zbnib5.exe
    "C:\Users\Admin\AppData\Local\Temp\k5dj2zbnib5.exe"
    3⤵
    PID:17048
- - C:\Users\Admin\AppData\Local\Temp\k2u1prsedfh.exe
    "C:\Users\Admin\AppData\Local\Temp\k2u1prsedfh.exe"
    3⤵
    PID:19960
- - C:\Users\Admin\AppData\Local\Temp\tipykovvdx0.exe
    "C:\Users\Admin\AppData\Local\Temp\tipykovvdx0.exe"
    3⤵
    PID:20672
- - C:\Users\Admin\AppData\Local\Temp\5hprs01arp3.exe
    "C:\Users\Admin\AppData\Local\Temp\5hprs01arp3.exe"
    3⤵
    PID:24932
- - C:\Users\Admin\AppData\Local\Temp\swejf15jq0d.exe
    "C:\Users\Admin\AppData\Local\Temp\swejf15jq0d.exe"
    3⤵
    PID:23624
- - C:\Users\Admin\AppData\Local\Temp\ybqb5ec4qfr.exe
    "C:\Users\Admin\AppData\Local\Temp\ybqb5ec4qfr.exe"
    3⤵
    PID:30092
- C:\Users\Admin\AppData\Local\Temp\ymqqfwo2xqy.exe
  "C:\Users\Admin\AppData\Local\Temp\ymqqfwo2xqy.exe"
  2⤵
  PID:3408
- - C:\Users\Admin\AppData\Local\Temp\zstbkkxzdfd.exe
    "C:\Users\Admin\AppData\Local\Temp\zstbkkxzdfd.exe"
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\ci3irpw40it.exe
    "C:\Users\Admin\AppData\Local\Temp\ci3irpw40it.exe"
    3⤵
    PID:13596
- - C:\Users\Admin\AppData\Local\Temp\ltxztnfeq31.exe
    "C:\Users\Admin\AppData\Local\Temp\ltxztnfeq31.exe"
    3⤵
    PID:16680
- - C:\Users\Admin\AppData\Local\Temp\4r40v51y4ra.exe
    "C:\Users\Admin\AppData\Local\Temp\4r40v51y4ra.exe"
    3⤵
    PID:17324
- - C:\Users\Admin\AppData\Local\Temp\dd5al5cyub2.exe
    "C:\Users\Admin\AppData\Local\Temp\dd5al5cyub2.exe"
    3⤵
    PID:19192
- - C:\Users\Admin\AppData\Local\Temp\r40nlxefmwi.exe
    "C:\Users\Admin\AppData\Local\Temp\r40nlxefmwi.exe"
    3⤵
    PID:23220
- - C:\Users\Admin\AppData\Local\Temp\uqfzoa21udv.exe
    "C:\Users\Admin\AppData\Local\Temp\uqfzoa21udv.exe"
    3⤵
    PID:25592
- - C:\Users\Admin\AppData\Local\Temp\bxatbeuvv2c.exe
    "C:\Users\Admin\AppData\Local\Temp\bxatbeuvv2c.exe"
    3⤵
    PID:28072
- - C:\Users\Admin\AppData\Local\Temp\dz1a1uaq3tq.exe
    "C:\Users\Admin\AppData\Local\Temp\dz1a1uaq3tq.exe"
    3⤵
    PID:25460
- C:\Users\Admin\AppData\Local\Temp\f3kom4tz0it.exe
  "C:\Users\Admin\AppData\Local\Temp\f3kom4tz0it.exe"
  2⤵
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\abym42nsafy.exe
    "C:\Users\Admin\AppData\Local\Temp\abym42nsafy.exe"
    3⤵
    PID:12124
- - C:\Users\Admin\AppData\Local\Temp\azgr1l1u24w.exe
    "C:\Users\Admin\AppData\Local\Temp\azgr1l1u24w.exe"
    3⤵
    PID:16896
- - C:\Users\Admin\AppData\Local\Temp\3ib4eno3oph.exe
    "C:\Users\Admin\AppData\Local\Temp\3ib4eno3oph.exe"
    3⤵
    PID:25952
- - C:\Users\Admin\AppData\Local\Temp\w3wfnawp4dw.exe
    "C:\Users\Admin\AppData\Local\Temp\w3wfnawp4dw.exe"
    3⤵
    PID:26416
- - C:\Users\Admin\AppData\Local\Temp\gelracnu4rc.exe
    "C:\Users\Admin\AppData\Local\Temp\gelracnu4rc.exe"
    3⤵
    PID:28320
- - C:\Users\Admin\AppData\Local\Temp\sfxtydwyfcf.exe
    "C:\Users\Admin\AppData\Local\Temp\sfxtydwyfcf.exe"
    3⤵
    PID:35544
- C:\Users\Admin\AppData\Local\Temp\pcaqszharxw.exe
  "C:\Users\Admin\AppData\Local\Temp\pcaqszharxw.exe"
  2⤵
  PID:3872
- - C:\Users\Admin\AppData\Local\Temp\facrvtpwlqd.exe
    "C:\Users\Admin\AppData\Local\Temp\facrvtpwlqd.exe"
    3⤵
    PID:12860
- - C:\Users\Admin\AppData\Local\Temp\w0xpwlqe21x.exe
    "C:\Users\Admin\AppData\Local\Temp\w0xpwlqe21x.exe"
    3⤵
    PID:15472
- - C:\Users\Admin\AppData\Local\Temp\yhixs1v55lw.exe
    "C:\Users\Admin\AppData\Local\Temp\yhixs1v55lw.exe"
    3⤵
    PID:23320
- - C:\Users\Admin\AppData\Local\Temp\vzbgw0vjr4d.exe
    "C:\Users\Admin\AppData\Local\Temp\vzbgw0vjr4d.exe"
    3⤵
    PID:26588
- - C:\Users\Admin\AppData\Local\Temp\3o4xejkmuof.exe
    "C:\Users\Admin\AppData\Local\Temp\3o4xejkmuof.exe"
    3⤵
    PID:26628
- - C:\Users\Admin\AppData\Local\Temp\t01naas4t3v.exe
    "C:\Users\Admin\AppData\Local\Temp\t01naas4t3v.exe"
    3⤵
    PID:26844
- - C:\Users\Admin\AppData\Local\Temp\wjr05zafkva.exe
    "C:\Users\Admin\AppData\Local\Temp\wjr05zafkva.exe"
    3⤵
    PID:14816
- C:\Users\Admin\AppData\Local\Temp\mog0nfs23yn.exe
  "C:\Users\Admin\AppData\Local\Temp\mog0nfs23yn.exe"
  2⤵
  PID:248
- - C:\Users\Admin\AppData\Local\Temp\mpao3uuej0f.exe
    "C:\Users\Admin\AppData\Local\Temp\mpao3uuej0f.exe"
    3⤵
    PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\m3w5zqkyg13.exe
      "C:\Users\Admin\AppData\Local\Temp\m3w5zqkyg13.exe"
      4⤵
      PID:35284
- - C:\Users\Admin\AppData\Local\Temp\bv1o2durudx.exe
    "C:\Users\Admin\AppData\Local\Temp\bv1o2durudx.exe"
    3⤵
    PID:11832
- - C:\Users\Admin\AppData\Local\Temp\rik43z0yhvs.exe
    "C:\Users\Admin\AppData\Local\Temp\rik43z0yhvs.exe"
    3⤵
    PID:13356
- - C:\Users\Admin\AppData\Local\Temp\qumaouarogy.exe
    "C:\Users\Admin\AppData\Local\Temp\qumaouarogy.exe"
    3⤵
    PID:16564
- - C:\Users\Admin\AppData\Local\Temp\4rnx33a2ueb.exe
    "C:\Users\Admin\AppData\Local\Temp\4rnx33a2ueb.exe"
    3⤵
    PID:16368
- - C:\Users\Admin\AppData\Local\Temp\jwqqyu0cc50.exe
    "C:\Users\Admin\AppData\Local\Temp\jwqqyu0cc50.exe"
    3⤵
    PID:20272
- - C:\Users\Admin\AppData\Local\Temp\ll3pjqqr04s.exe
    "C:\Users\Admin\AppData\Local\Temp\ll3pjqqr04s.exe"
    3⤵
    PID:23852
- - C:\Users\Admin\AppData\Local\Temp\xsos1xo043i.exe
    "C:\Users\Admin\AppData\Local\Temp\xsos1xo043i.exe"
    3⤵
    PID:25768
- - C:\Users\Admin\AppData\Local\Temp\yafbeajeus3.exe
    "C:\Users\Admin\AppData\Local\Temp\yafbeajeus3.exe"
    3⤵
    PID:27964
- - C:\Users\Admin\AppData\Local\Temp\eajj3c2wgiy.exe
    "C:\Users\Admin\AppData\Local\Temp\eajj3c2wgiy.exe"
    3⤵
    PID:10792
- - C:\Users\Admin\AppData\Local\Temp\2uos03eirwb.exe
    "C:\Users\Admin\AppData\Local\Temp\2uos03eirwb.exe"
    3⤵
    PID:28716
- C:\Users\Admin\AppData\Local\Temp\b4wtuaup0uo.exe
  "C:\Users\Admin\AppData\Local\Temp\b4wtuaup0uo.exe"
  2⤵
  PID:1028
- - C:\Users\Admin\AppData\Local\Temp\l4nnqkzksef.exe
    "C:\Users\Admin\AppData\Local\Temp\l4nnqkzksef.exe"
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Local\Temp\vscjorq3k01.exe
    "C:\Users\Admin\AppData\Local\Temp\vscjorq3k01.exe"
    3⤵
    PID:13640
- - C:\Users\Admin\AppData\Local\Temp\3psvwnpxmop.exe
    "C:\Users\Admin\AppData\Local\Temp\3psvwnpxmop.exe"
    3⤵
    PID:7496
- - C:\Users\Admin\AppData\Local\Temp\3fn134fsudx.exe
    "C:\Users\Admin\AppData\Local\Temp\3fn134fsudx.exe"
    3⤵
    PID:4128
- - C:\Users\Admin\AppData\Local\Temp\znuxcytryfg.exe
    "C:\Users\Admin\AppData\Local\Temp\znuxcytryfg.exe"
    3⤵
    PID:21908
- - C:\Users\Admin\AppData\Local\Temp\ieijsllckgf.exe
    "C:\Users\Admin\AppData\Local\Temp\ieijsllckgf.exe"
    3⤵
    PID:21488
- - C:\Users\Admin\AppData\Local\Temp\bwhrnitcxni.exe
    "C:\Users\Admin\AppData\Local\Temp\bwhrnitcxni.exe"
    3⤵
    PID:26344
- - C:\Users\Admin\AppData\Local\Temp\k3tysg4zmfg.exe
    "C:\Users\Admin\AppData\Local\Temp\k3tysg4zmfg.exe"
    3⤵
    PID:11428
- C:\Users\Admin\AppData\Local\Temp\stuuap3kaia.exe
  "C:\Users\Admin\AppData\Local\Temp\stuuap3kaia.exe"
  2⤵
  PID:2848
- - C:\Users\Admin\AppData\Local\Temp\fwzq4ejv1fr.exe
    "C:\Users\Admin\AppData\Local\Temp\fwzq4ejv1fr.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\lacybwrr4w2.exe
    "C:\Users\Admin\AppData\Local\Temp\lacybwrr4w2.exe"
    3⤵
    PID:13292
- - C:\Users\Admin\AppData\Local\Temp\aurtmjlgnsi.exe
    "C:\Users\Admin\AppData\Local\Temp\aurtmjlgnsi.exe"
    3⤵
    PID:16080
- - C:\Users\Admin\AppData\Local\Temp\wjrckm2zzij.exe
    "C:\Users\Admin\AppData\Local\Temp\wjrckm2zzij.exe"
    3⤵
    PID:23760
- - C:\Users\Admin\AppData\Local\Temp\ukcxbylizzs.exe
    "C:\Users\Admin\AppData\Local\Temp\ukcxbylizzs.exe"
    3⤵
    PID:4884
- - C:\Users\Admin\AppData\Local\Temp\z0js2g1qce0.exe
    "C:\Users\Admin\AppData\Local\Temp\z0js2g1qce0.exe"
    3⤵
    PID:3704
- - C:\Users\Admin\AppData\Local\Temp\ow0zkxqklwo.exe
    "C:\Users\Admin\AppData\Local\Temp\ow0zkxqklwo.exe"
    3⤵
    PID:28168
- - C:\Users\Admin\AppData\Local\Temp\hqvh1eebnn2.exe
    "C:\Users\Admin\AppData\Local\Temp\hqvh1eebnn2.exe"
    3⤵
    PID:30756
- C:\Users\Admin\AppData\Local\Temp\xqftu1m41i0.exe
  "C:\Users\Admin\AppData\Local\Temp\xqftu1m41i0.exe"
  2⤵
  PID:3720
- - C:\Users\Admin\AppData\Local\Temp\k1lprphtuks.exe
    "C:\Users\Admin\AppData\Local\Temp\k1lprphtuks.exe"
    3⤵
    PID:13748
- - C:\Users\Admin\AppData\Local\Temp\fttcjs0jfn1.exe
    "C:\Users\Admin\AppData\Local\Temp\fttcjs0jfn1.exe"
    3⤵
    PID:16532
- - C:\Users\Admin\AppData\Local\Temp\wtvtfne2fuq.exe
    "C:\Users\Admin\AppData\Local\Temp\wtvtfne2fuq.exe"
    3⤵
    PID:16364
- - C:\Users\Admin\AppData\Local\Temp\aq5g4wbh4tc.exe
    "C:\Users\Admin\AppData\Local\Temp\aq5g4wbh4tc.exe"
    3⤵
    PID:17984
- - C:\Users\Admin\AppData\Local\Temp\hgva4r4lc5m.exe
    "C:\Users\Admin\AppData\Local\Temp\hgva4r4lc5m.exe"
    3⤵
    PID:5540
- - C:\Users\Admin\AppData\Local\Temp\u11kmwrapvt.exe
    "C:\Users\Admin\AppData\Local\Temp\u11kmwrapvt.exe"
    3⤵
    PID:25696
- - C:\Users\Admin\AppData\Local\Temp\5zttcielvhz.exe
    "C:\Users\Admin\AppData\Local\Temp\5zttcielvhz.exe"
    3⤵
    PID:22208
- - C:\Users\Admin\AppData\Local\Temp\532iotzz124.exe
    "C:\Users\Admin\AppData\Local\Temp\532iotzz124.exe"
    3⤵
    PID:27472
- C:\Users\Admin\AppData\Local\Temp\cfcybrwhntg.exe
  "C:\Users\Admin\AppData\Local\Temp\cfcybrwhntg.exe"
  2⤵
  PID:5048
- - C:\Users\Admin\AppData\Local\Temp\p4gycwbk0hg.exe
    "C:\Users\Admin\AppData\Local\Temp\p4gycwbk0hg.exe"
    3⤵
    PID:11516
- - C:\Users\Admin\AppData\Local\Temp\kypxcd2lj5l.exe
    "C:\Users\Admin\AppData\Local\Temp\kypxcd2lj5l.exe"
    3⤵
    PID:13148
- - C:\Users\Admin\AppData\Local\Temp\yxz5jwxjpap.exe
    "C:\Users\Admin\AppData\Local\Temp\yxz5jwxjpap.exe"
    3⤵
    PID:16592
- - C:\Users\Admin\AppData\Local\Temp\ytapbal25vg.exe
    "C:\Users\Admin\AppData\Local\Temp\ytapbal25vg.exe"
    3⤵
    PID:24408
- - C:\Users\Admin\AppData\Local\Temp\gi2fahb22qh.exe
    "C:\Users\Admin\AppData\Local\Temp\gi2fahb22qh.exe"
    3⤵
    PID:21424
- - C:\Users\Admin\AppData\Local\Temp\c5213v2mvim.exe
    "C:\Users\Admin\AppData\Local\Temp\c5213v2mvim.exe"
    3⤵
    PID:29488
- - C:\Users\Admin\AppData\Local\Temp\ovzcc1g4pbu.exe
    "C:\Users\Admin\AppData\Local\Temp\ovzcc1g4pbu.exe"
    3⤵
    PID:7488
- C:\Users\Admin\AppData\Local\Temp\2zhhlsn44bl.exe
  "C:\Users\Admin\AppData\Local\Temp\2zhhlsn44bl.exe"
  2⤵
  PID:5140
- - C:\Users\Admin\AppData\Local\Temp\2h2345kux5x.exe
    "C:\Users\Admin\AppData\Local\Temp\2h2345kux5x.exe"
    3⤵
    PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\bpthq1jr1c0.exe
      "C:\Users\Admin\AppData\Local\Temp\bpthq1jr1c0.exe"
      4⤵
      PID:18980
  - - C:\Users\Admin\AppData\Local\Temp\qjeiyarjonv.exe
      "C:\Users\Admin\AppData\Local\Temp\qjeiyarjonv.exe"
      4⤵
      PID:19628
  - - C:\Users\Admin\AppData\Local\Temp\jxwtj01yp15.exe
      "C:\Users\Admin\AppData\Local\Temp\jxwtj01yp15.exe"
      4⤵
      PID:24664
  - - C:\Users\Admin\AppData\Local\Temp\2tdlarj5vit.exe
      "C:\Users\Admin\AppData\Local\Temp\2tdlarj5vit.exe"
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\rrqbkt5mril.exe
      "C:\Users\Admin\AppData\Local\Temp\rrqbkt5mril.exe"
      4⤵
      PID:8084
- - C:\Users\Admin\AppData\Local\Temp\esb54nuimqv.exe
    "C:\Users\Admin\AppData\Local\Temp\esb54nuimqv.exe"
    3⤵
    PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\lwhcwmqpihm.exe
      "C:\Users\Admin\AppData\Local\Temp\lwhcwmqpihm.exe"
      4⤵
      PID:32272
- - C:\Users\Admin\AppData\Local\Temp\if55q5ggoyh.exe
    "C:\Users\Admin\AppData\Local\Temp\if55q5ggoyh.exe"
    3⤵
    PID:10660
- - C:\Users\Admin\AppData\Local\Temp\sqojdnp4wit.exe
    "C:\Users\Admin\AppData\Local\Temp\sqojdnp4wit.exe"
    3⤵
    PID:10740
- - C:\Users\Admin\AppData\Local\Temp\qbrxd2tvgti.exe
    "C:\Users\Admin\AppData\Local\Temp\qbrxd2tvgti.exe"
    3⤵
    PID:14580
- - C:\Users\Admin\AppData\Local\Temp\5lohe4w1o2d.exe
    "C:\Users\Admin\AppData\Local\Temp\5lohe4w1o2d.exe"
    3⤵
    PID:18040
- - C:\Users\Admin\AppData\Local\Temp\kb0i1bfhq0r.exe
    "C:\Users\Admin\AppData\Local\Temp\kb0i1bfhq0r.exe"
    3⤵
    PID:19508
- - C:\Users\Admin\AppData\Local\Temp\h40xxd5ivtl.exe
    "C:\Users\Admin\AppData\Local\Temp\h40xxd5ivtl.exe"
    3⤵
    PID:23380
- - C:\Users\Admin\AppData\Local\Temp\gyftj2zwqt5.exe
    "C:\Users\Admin\AppData\Local\Temp\gyftj2zwqt5.exe"
    3⤵
    PID:23780
- - C:\Users\Admin\AppData\Local\Temp\xidwbvruszj.exe
    "C:\Users\Admin\AppData\Local\Temp\xidwbvruszj.exe"
    3⤵
    PID:27044
- - C:\Users\Admin\AppData\Local\Temp\dstuqadhx1f.exe
    "C:\Users\Admin\AppData\Local\Temp\dstuqadhx1f.exe"
    3⤵
    PID:26712
- - C:\Users\Admin\AppData\Local\Temp\b245fs4xxb0.exe
    "C:\Users\Admin\AppData\Local\Temp\b245fs4xxb0.exe"
    3⤵
    PID:28312
- C:\Users\Admin\AppData\Local\Temp\dg0lwwmttan.exe
  "C:\Users\Admin\AppData\Local\Temp\dg0lwwmttan.exe"
  2⤵
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\du4ckfu3rib.exe
    "C:\Users\Admin\AppData\Local\Temp\du4ckfu3rib.exe"
    3⤵
    PID:11864
- - C:\Users\Admin\AppData\Local\Temp\0xfkigphw4m.exe
    "C:\Users\Admin\AppData\Local\Temp\0xfkigphw4m.exe"
    3⤵
    PID:15084
- - C:\Users\Admin\AppData\Local\Temp\wen55gr2b0w.exe
    "C:\Users\Admin\AppData\Local\Temp\wen55gr2b0w.exe"
    3⤵
    PID:15956
- - C:\Users\Admin\AppData\Local\Temp\juat4pm5bci.exe
    "C:\Users\Admin\AppData\Local\Temp\juat4pm5bci.exe"
    3⤵
    PID:20024
- - C:\Users\Admin\AppData\Local\Temp\nh341glq4ef.exe
    "C:\Users\Admin\AppData\Local\Temp\nh341glq4ef.exe"
    3⤵
    PID:20644
- - C:\Users\Admin\AppData\Local\Temp\gc5jbbnpgra.exe
    "C:\Users\Admin\AppData\Local\Temp\gc5jbbnpgra.exe"
    3⤵
    PID:21704
- - C:\Users\Admin\AppData\Local\Temp\aq1xeasynf5.exe
    "C:\Users\Admin\AppData\Local\Temp\aq1xeasynf5.exe"
    3⤵
    PID:28200
- - C:\Users\Admin\AppData\Local\Temp\q0d45sim3xd.exe
    "C:\Users\Admin\AppData\Local\Temp\q0d45sim3xd.exe"
    3⤵
    PID:24108
- - C:\Users\Admin\AppData\Local\Temp\gsbhwamzlav.exe
    "C:\Users\Admin\AppData\Local\Temp\gsbhwamzlav.exe"
    3⤵
    PID:20912
- - C:\Users\Admin\AppData\Local\Temp\1dnqwei3elf.exe
    "C:\Users\Admin\AppData\Local\Temp\1dnqwei3elf.exe"
    3⤵
    PID:35204
- C:\Users\Admin\AppData\Local\Temp\myky0m1lwru.exe
  "C:\Users\Admin\AppData\Local\Temp\myky0m1lwru.exe"
  2⤵
  PID:5408
- - C:\Users\Admin\AppData\Local\Temp\1xcybaetsp4.exe
    "C:\Users\Admin\AppData\Local\Temp\1xcybaetsp4.exe"
    3⤵
    PID:11848
- - C:\Users\Admin\AppData\Local\Temp\bkwqdx3jxab.exe
    "C:\Users\Admin\AppData\Local\Temp\bkwqdx3jxab.exe"
    3⤵
    PID:15052
- - C:\Users\Admin\AppData\Local\Temp\2sox1inrkti.exe
    "C:\Users\Admin\AppData\Local\Temp\2sox1inrkti.exe"
    3⤵
    PID:16044
- - C:\Users\Admin\AppData\Local\Temp\lkkc3zwfi14.exe
    "C:\Users\Admin\AppData\Local\Temp\lkkc3zwfi14.exe"
    3⤵
    PID:21380
- - C:\Users\Admin\AppData\Local\Temp\vkbbku3121o.exe
    "C:\Users\Admin\AppData\Local\Temp\vkbbku3121o.exe"
    3⤵
    PID:20708
- - C:\Users\Admin\AppData\Local\Temp\feehicugpao.exe
    "C:\Users\Admin\AppData\Local\Temp\feehicugpao.exe"
    3⤵
    PID:6956
- - C:\Users\Admin\AppData\Local\Temp\vfscz1ojpyn.exe
    "C:\Users\Admin\AppData\Local\Temp\vfscz1ojpyn.exe"
    3⤵
    PID:29948
- C:\Users\Admin\AppData\Local\Temp\aaxygsuu3lm.exe
  "C:\Users\Admin\AppData\Local\Temp\aaxygsuu3lm.exe"
  2⤵
  PID:5768
- - C:\Users\Admin\AppData\Local\Temp\gsmulmh3sx5.exe
    "C:\Users\Admin\AppData\Local\Temp\gsmulmh3sx5.exe"
    3⤵
    PID:6232
  - - C:\Users\Admin\AppData\Local\Temp\zxaqzpp4emg.exe
      "C:\Users\Admin\AppData\Local\Temp\zxaqzpp4emg.exe"
      4⤵
      PID:19096
  - - C:\Users\Admin\AppData\Local\Temp\fgxyl5niw1x.exe
      "C:\Users\Admin\AppData\Local\Temp\fgxyl5niw1x.exe"
      4⤵
      PID:22244
  - - C:\Users\Admin\AppData\Local\Temp\hrfwo4bslo4.exe
      "C:\Users\Admin\AppData\Local\Temp\hrfwo4bslo4.exe"
      4⤵
      PID:21112
  - - C:\Users\Admin\AppData\Local\Temp\yas5ccv05sw.exe
      "C:\Users\Admin\AppData\Local\Temp\yas5ccv05sw.exe"
      4⤵
      PID:28436
  - - C:\Users\Admin\AppData\Local\Temp\pnua4wvddtx.exe
      "C:\Users\Admin\AppData\Local\Temp\pnua4wvddtx.exe"
      4⤵
      PID:26664
  - - C:\Users\Admin\AppData\Local\Temp\5jwkwc0obvp.exe
      "C:\Users\Admin\AppData\Local\Temp\5jwkwc0obvp.exe"
      4⤵
      PID:32828
- - C:\Users\Admin\AppData\Local\Temp\johy3re2znb.exe
    "C:\Users\Admin\AppData\Local\Temp\johy3re2znb.exe"
    3⤵
    PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\qipvrpbyj5g.exe
      "C:\Users\Admin\AppData\Local\Temp\qipvrpbyj5g.exe"
      4⤵
      PID:27360
  - - C:\Users\Admin\AppData\Local\Temp\gug2eruanfh.exe
      "C:\Users\Admin\AppData\Local\Temp\gug2eruanfh.exe"
      4⤵
      PID:32424
- - C:\Users\Admin\AppData\Local\Temp\4oedzc3wxrb.exe
    "C:\Users\Admin\AppData\Local\Temp\4oedzc3wxrb.exe"
    3⤵
    PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\1djk303orss.exe
      "C:\Users\Admin\AppData\Local\Temp\1djk303orss.exe"
      4⤵
      PID:35304
- - C:\Users\Admin\AppData\Local\Temp\xtoyabjyruw.exe
    "C:\Users\Admin\AppData\Local\Temp\xtoyabjyruw.exe"
    3⤵
    PID:12092
- - C:\Users\Admin\AppData\Local\Temp\03stznwhpfr.exe
    "C:\Users\Admin\AppData\Local\Temp\03stznwhpfr.exe"
    3⤵
    PID:14708
- - C:\Users\Admin\AppData\Local\Temp\tjrqsi2ax4v.exe
    "C:\Users\Admin\AppData\Local\Temp\tjrqsi2ax4v.exe"
    3⤵
    PID:15076
- - C:\Users\Admin\AppData\Local\Temp\irx2cqxt1ly.exe
    "C:\Users\Admin\AppData\Local\Temp\irx2cqxt1ly.exe"
    3⤵
    PID:4412
- - C:\Users\Admin\AppData\Local\Temp\tubqeclnbar.exe
    "C:\Users\Admin\AppData\Local\Temp\tubqeclnbar.exe"
    3⤵
    PID:19472
- - C:\Users\Admin\AppData\Local\Temp\1sdecucrvy0.exe
    "C:\Users\Admin\AppData\Local\Temp\1sdecucrvy0.exe"
    3⤵
    PID:23868
- - C:\Users\Admin\AppData\Local\Temp\ekv4p4q3f1t.exe
    "C:\Users\Admin\AppData\Local\Temp\ekv4p4q3f1t.exe"
    3⤵
    PID:26680
- - C:\Users\Admin\AppData\Local\Temp\nl4p2bsg4sf.exe
    "C:\Users\Admin\AppData\Local\Temp\nl4p2bsg4sf.exe"
    3⤵
    PID:9564
- - C:\Users\Admin\AppData\Local\Temp\cpss3ga1kgd.exe
    "C:\Users\Admin\AppData\Local\Temp\cpss3ga1kgd.exe"
    3⤵
    PID:27216
- C:\Users\Admin\AppData\Local\Temp\fn2a2soeq5o.exe
  "C:\Users\Admin\AppData\Local\Temp\fn2a2soeq5o.exe"
  2⤵
  PID:6116
- - C:\Users\Admin\AppData\Local\Temp\wumz5vwvkub.exe
    "C:\Users\Admin\AppData\Local\Temp\wumz5vwvkub.exe"
    3⤵
    PID:14828
- - C:\Users\Admin\AppData\Local\Temp\xdlmx5bzrig.exe
    "C:\Users\Admin\AppData\Local\Temp\xdlmx5bzrig.exe"
    3⤵
    PID:15872
- - C:\Users\Admin\AppData\Local\Temp\nmijkmwauo4.exe
    "C:\Users\Admin\AppData\Local\Temp\nmijkmwauo4.exe"
    3⤵
    PID:18388
- - C:\Users\Admin\AppData\Local\Temp\qfll5fdybdu.exe
    "C:\Users\Admin\AppData\Local\Temp\qfll5fdybdu.exe"
    3⤵
    PID:21832
- - C:\Users\Admin\AppData\Local\Temp\bx5e3mzakgt.exe
    "C:\Users\Admin\AppData\Local\Temp\bx5e3mzakgt.exe"
    3⤵
    PID:22916
- - C:\Users\Admin\AppData\Local\Temp\5wrf4j14vm0.exe
    "C:\Users\Admin\AppData\Local\Temp\5wrf4j14vm0.exe"
    3⤵
    PID:1100
- - C:\Users\Admin\AppData\Local\Temp\4ygilbsdav1.exe
    "C:\Users\Admin\AppData\Local\Temp\4ygilbsdav1.exe"
    3⤵
    PID:27240
- - C:\Users\Admin\AppData\Local\Temp\tcn5gfsmaal.exe
    "C:\Users\Admin\AppData\Local\Temp\tcn5gfsmaal.exe"
    3⤵
    PID:32836
- C:\Users\Admin\AppData\Local\Temp\ch31lbcprwl.exe
  "C:\Users\Admin\AppData\Local\Temp\ch31lbcprwl.exe"
  2⤵
  PID:2664
- - C:\Users\Admin\AppData\Local\Temp\20zeckavvpf.exe
    "C:\Users\Admin\AppData\Local\Temp\20zeckavvpf.exe"
    3⤵
    PID:13504
- - C:\Users\Admin\AppData\Local\Temp\zceeaahtaw1.exe
    "C:\Users\Admin\AppData\Local\Temp\zceeaahtaw1.exe"
    3⤵
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\r2bij0z1zh5.exe
    "C:\Users\Admin\AppData\Local\Temp\r2bij0z1zh5.exe"
    3⤵
    PID:17164
- - C:\Users\Admin\AppData\Local\Temp\34bbfg4wur3.exe
    "C:\Users\Admin\AppData\Local\Temp\34bbfg4wur3.exe"
    3⤵
    PID:18420
- - C:\Users\Admin\AppData\Local\Temp\3scsnodnc3k.exe
    "C:\Users\Admin\AppData\Local\Temp\3scsnodnc3k.exe"
    3⤵
    PID:20532
- - C:\Users\Admin\AppData\Local\Temp\liztdd3c42v.exe
    "C:\Users\Admin\AppData\Local\Temp\liztdd3c42v.exe"
    3⤵
    PID:3900
- - C:\Users\Admin\AppData\Local\Temp\knvu2co0tpk.exe
    "C:\Users\Admin\AppData\Local\Temp\knvu2co0tpk.exe"
    3⤵
    PID:27664
- - C:\Users\Admin\AppData\Local\Temp\ehh5p2mq1wd.exe
    "C:\Users\Admin\AppData\Local\Temp\ehh5p2mq1wd.exe"
    3⤵
    PID:21660
- - C:\Users\Admin\AppData\Local\Temp\zppzfq5o2ol.exe
    "C:\Users\Admin\AppData\Local\Temp\zppzfq5o2ol.exe"
    3⤵
    PID:30764
- C:\Users\Admin\AppData\Local\Temp\hggdso1nrto.exe
  "C:\Users\Admin\AppData\Local\Temp\hggdso1nrto.exe"
  2⤵
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\mtshg5wisxa.exe
    "C:\Users\Admin\AppData\Local\Temp\mtshg5wisxa.exe"
    3⤵
    PID:15308
- - C:\Users\Admin\AppData\Local\Temp\cogzthfiru3.exe
    "C:\Users\Admin\AppData\Local\Temp\cogzthfiru3.exe"
    3⤵
    PID:18712
- - C:\Users\Admin\AppData\Local\Temp\ly4oxa2p0gh.exe
    "C:\Users\Admin\AppData\Local\Temp\ly4oxa2p0gh.exe"
    3⤵
    PID:18852
- - C:\Users\Admin\AppData\Local\Temp\wrlcnoprx3t.exe
    "C:\Users\Admin\AppData\Local\Temp\wrlcnoprx3t.exe"
    3⤵
    PID:23580
- - C:\Users\Admin\AppData\Local\Temp\2j2ps5dfrpd.exe
    "C:\Users\Admin\AppData\Local\Temp\2j2ps5dfrpd.exe"
    3⤵
    PID:26856
- - C:\Users\Admin\AppData\Local\Temp\zc03efaff2f.exe
    "C:\Users\Admin\AppData\Local\Temp\zc03efaff2f.exe"
    3⤵
    PID:26732
- - C:\Users\Admin\AppData\Local\Temp\plkvdnhgths.exe
    "C:\Users\Admin\AppData\Local\Temp\plkvdnhgths.exe"
    3⤵
    PID:27404
- C:\Users\Admin\AppData\Local\Temp\iuosvu21bpi.exe
  "C:\Users\Admin\AppData\Local\Temp\iuosvu21bpi.exe"
  2⤵
  PID:4580
- - C:\Users\Admin\AppData\Local\Temp\21p4xnty3gd.exe
    "C:\Users\Admin\AppData\Local\Temp\21p4xnty3gd.exe"
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\ps1otpqnmfv.exe
    "C:\Users\Admin\AppData\Local\Temp\ps1otpqnmfv.exe"
    3⤵
    PID:14448
- - C:\Users\Admin\AppData\Local\Temp\x5wxxydilk5.exe
    "C:\Users\Admin\AppData\Local\Temp\x5wxxydilk5.exe"
    3⤵
    PID:15140
- - C:\Users\Admin\AppData\Local\Temp\o4pv1evykix.exe
    "C:\Users\Admin\AppData\Local\Temp\o4pv1evykix.exe"
    3⤵
    PID:19928
- - C:\Users\Admin\AppData\Local\Temp\llqacvfcygb.exe
    "C:\Users\Admin\AppData\Local\Temp\llqacvfcygb.exe"
    3⤵
    PID:21220
- - C:\Users\Admin\AppData\Local\Temp\05gzhhgxfgm.exe
    "C:\Users\Admin\AppData\Local\Temp\05gzhhgxfgm.exe"
    3⤵
    PID:24616
- - C:\Users\Admin\AppData\Local\Temp\o0uyrdk4sgh.exe
    "C:\Users\Admin\AppData\Local\Temp\o0uyrdk4sgh.exe"
    3⤵
    PID:22376
- - C:\Users\Admin\AppData\Local\Temp\ezzkgatlhbl.exe
    "C:\Users\Admin\AppData\Local\Temp\ezzkgatlhbl.exe"
    3⤵
    PID:31580
- C:\Users\Admin\AppData\Local\Temp\crxdjz5d1es.exe
  "C:\Users\Admin\AppData\Local\Temp\crxdjz5d1es.exe"
  2⤵
  PID:4732
- - C:\Users\Admin\AppData\Local\Temp\wzobpftjtqm.exe
    "C:\Users\Admin\AppData\Local\Temp\wzobpftjtqm.exe"
    3⤵
    PID:17284
- - C:\Users\Admin\AppData\Local\Temp\4x2cgbda5vp.exe
    "C:\Users\Admin\AppData\Local\Temp\4x2cgbda5vp.exe"
    3⤵
    PID:4240
- - C:\Users\Admin\AppData\Local\Temp\njwbw03gujd.exe
    "C:\Users\Admin\AppData\Local\Temp\njwbw03gujd.exe"
    3⤵
    PID:19160
- - C:\Users\Admin\AppData\Local\Temp\lo54ygtfavo.exe
    "C:\Users\Admin\AppData\Local\Temp\lo54ygtfavo.exe"
    3⤵
    PID:23212
- - C:\Users\Admin\AppData\Local\Temp\ms3h21xpw1b.exe
    "C:\Users\Admin\AppData\Local\Temp\ms3h21xpw1b.exe"
    3⤵
    PID:25688
- - C:\Users\Admin\AppData\Local\Temp\pel5cs3rzja.exe
    "C:\Users\Admin\AppData\Local\Temp\pel5cs3rzja.exe"
    3⤵
    PID:27620
- - C:\Users\Admin\AppData\Local\Temp\5g5ajmingrr.exe
    "C:\Users\Admin\AppData\Local\Temp\5g5ajmingrr.exe"
    3⤵
    PID:26240
- - C:\Users\Admin\AppData\Local\Temp\ukf0tra4bby.exe
    "C:\Users\Admin\AppData\Local\Temp\ukf0tra4bby.exe"
    3⤵
    PID:32176
- C:\Users\Admin\AppData\Local\Temp\zwpkm2gymmu.exe
  "C:\Users\Admin\AppData\Local\Temp\zwpkm2gymmu.exe"
  2⤵
  PID:3904
- - C:\Users\Admin\AppData\Local\Temp\fnkw2lj204w.exe
    "C:\Users\Admin\AppData\Local\Temp\fnkw2lj204w.exe"
    3⤵
    PID:19416
- - C:\Users\Admin\AppData\Local\Temp\ifnihucm5y5.exe
    "C:\Users\Admin\AppData\Local\Temp\ifnihucm5y5.exe"
    3⤵
    PID:20756
- - C:\Users\Admin\AppData\Local\Temp\ha5grvs1ezt.exe
    "C:\Users\Admin\AppData\Local\Temp\ha5grvs1ezt.exe"
    3⤵
    PID:20632
- - C:\Users\Admin\AppData\Local\Temp\hkbwinwlvl5.exe
    "C:\Users\Admin\AppData\Local\Temp\hkbwinwlvl5.exe"
    3⤵
    PID:26720
- - C:\Users\Admin\AppData\Local\Temp\0fdidh4nqeo.exe
    "C:\Users\Admin\AppData\Local\Temp\0fdidh4nqeo.exe"
    3⤵
    PID:29688
- - C:\Users\Admin\AppData\Local\Temp\p1jd2mstpoi.exe
    "C:\Users\Admin\AppData\Local\Temp\p1jd2mstpoi.exe"
    3⤵
    PID:12852
- C:\Users\Admin\AppData\Local\Temp\mtjhx0b1rsl.exe
  "C:\Users\Admin\AppData\Local\Temp\mtjhx0b1rsl.exe"
  2⤵
  PID:4648
- - C:\Users\Admin\AppData\Local\Temp\3rhqefe4rrl.exe
    "C:\Users\Admin\AppData\Local\Temp\3rhqefe4rrl.exe"
    3⤵
    PID:20484
- - C:\Users\Admin\AppData\Local\Temp\ufv1ue1d22g.exe
    "C:\Users\Admin\AppData\Local\Temp\ufv1ue1d22g.exe"
    3⤵
    PID:11256
- - C:\Users\Admin\AppData\Local\Temp\nnonap5xsk4.exe
    "C:\Users\Admin\AppData\Local\Temp\nnonap5xsk4.exe"
    3⤵
    PID:32440
- C:\Users\Admin\AppData\Local\Temp\xvg2qq0w4dh.exe
  "C:\Users\Admin\AppData\Local\Temp\xvg2qq0w4dh.exe"
  2⤵
  PID:7456
- - C:\Users\Admin\AppData\Local\Temp\wjdwqxqjcm3.exe
    "C:\Users\Admin\AppData\Local\Temp\wjdwqxqjcm3.exe"
    3⤵
    PID:19116
- - C:\Users\Admin\AppData\Local\Temp\42gbc25kvjb.exe
    "C:\Users\Admin\AppData\Local\Temp\42gbc25kvjb.exe"
    3⤵
    PID:24808
- - C:\Users\Admin\AppData\Local\Temp\idhgmyyswni.exe
    "C:\Users\Admin\AppData\Local\Temp\idhgmyyswni.exe"
    3⤵
    PID:20664
- - C:\Users\Admin\AppData\Local\Temp\neqxdicotxo.exe
    "C:\Users\Admin\AppData\Local\Temp\neqxdicotxo.exe"
    3⤵
    PID:29364
- - C:\Users\Admin\AppData\Local\Temp\g1pschunaj5.exe
    "C:\Users\Admin\AppData\Local\Temp\g1pschunaj5.exe"
    3⤵
    PID:31292
- C:\Users\Admin\AppData\Local\Temp\ibncyy4pvek.exe
  "C:\Users\Admin\AppData\Local\Temp\ibncyy4pvek.exe"
  2⤵
  PID:6508
- - C:\Users\Admin\AppData\Local\Temp\k1pk02pzv5o.exe
    "C:\Users\Admin\AppData\Local\Temp\k1pk02pzv5o.exe"
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\h323qhny0y3.exe
    "C:\Users\Admin\AppData\Local\Temp\h323qhny0y3.exe"
    3⤵
    PID:30100
- C:\Users\Admin\AppData\Local\Temp\citbukx5tm4.exe
  "C:\Users\Admin\AppData\Local\Temp\citbukx5tm4.exe"
  2⤵
  PID:8520
- - C:\Users\Admin\AppData\Local\Temp\mxdzh54akqc.exe
    "C:\Users\Admin\AppData\Local\Temp\mxdzh54akqc.exe"
    3⤵
    PID:27712
- - C:\Users\Admin\AppData\Local\Temp\pxtts2w4pph.exe
    "C:\Users\Admin\AppData\Local\Temp\pxtts2w4pph.exe"
    3⤵
    PID:16132
- C:\Users\Admin\AppData\Local\Temp\d5qs4ogc3kv.exe
  "C:\Users\Admin\AppData\Local\Temp\d5qs4ogc3kv.exe"
  2⤵
  PID:10072
- - C:\Users\Admin\AppData\Local\Temp\byoxxnscdki.exe
    "C:\Users\Admin\AppData\Local\Temp\byoxxnscdki.exe"
    3⤵
    PID:33956
- C:\Users\Admin\AppData\Local\Temp\z5mbq4mjndo.exe
  "C:\Users\Admin\AppData\Local\Temp\z5mbq4mjndo.exe"
  2⤵
  PID:10848
- C:\Users\Admin\AppData\Local\Temp\0xmqqfx5gs3.exe
  "C:\Users\Admin\AppData\Local\Temp\0xmqqfx5gs3.exe"
  2⤵
  PID:12784
- C:\Users\Admin\AppData\Local\Temp\a2pyxuihfeh.exe
  "C:\Users\Admin\AppData\Local\Temp\a2pyxuihfeh.exe"
  2⤵
  PID:16236
- C:\Users\Admin\AppData\Local\Temp\lqq14cn3hap.exe
  "C:\Users\Admin\AppData\Local\Temp\lqq14cn3hap.exe"
  2⤵
  PID:23040
- C:\Users\Admin\AppData\Local\Temp\m5nrbto23yh.exe
  "C:\Users\Admin\AppData\Local\Temp\m5nrbto23yh.exe"
  2⤵
  PID:24240
- C:\Users\Admin\AppData\Local\Temp\qu3230q0lef.exe
  "C:\Users\Admin\AppData\Local\Temp\qu3230q0lef.exe"
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\2v2ctpipmfu.exe
  "C:\Users\Admin\AppData\Local\Temp\2v2ctpipmfu.exe"
  2⤵
  PID:11736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\v3qhqbdtzod.exe

Filesize
20KB

MD5
f68c3c4cc9119f67a3741923b9c57825

SHA1
39e7aca6ab3f13aab9129b09792b9563d820613e

SHA256
4e0c304587581041658fc0cc72a53ae797839ae3b2acec8dd6df017dc0f68644

SHA512
4a128bb7f96c9649f9e27ec26e8c49f3dd292851e9368e3d3f8635516f09c27d07a9271a14d00fff0aa0b5ea40d462258a69085ab416a3eb796e444ddf314d26

Download Submit
memory/236-2530-0x0000000004CD0000-0x0000000004CE0000-memory.dmp

Filesize
64KB

Download
memory/236-722-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/248-1755-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/572-1451-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/572-2396-0x0000000005400000-0x0000000005410000-memory.dmp

Filesize
64KB

Download
memory/580-707-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/580-589-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/1028-1696-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/1068-790-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/1068-2423-0x0000000004C90000-0x0000000004CA0000-memory.dmp

Filesize
64KB

Download
memory/1132-632-0x0000000003190000-0x00000000031A0000-memory.dmp

Filesize
64KB

Download
memory/1212-170-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/1212-551-0x0000000005AD0000-0x0000000005AE0000-memory.dmp

Filesize
64KB

Download
memory/1612-1468-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2132-516-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2132-517-0x00000000053C0000-0x00000000053D0000-memory.dmp

Filesize
64KB

Download
memory/2260-529-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2304-1429-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2304-2224-0x0000000005660000-0x0000000005670000-memory.dmp

Filesize
64KB

Download
memory/2448-793-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2448-2253-0x0000000005190000-0x00000000051A0000-memory.dmp

Filesize
64KB

Download
memory/2704-45-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/2704-189-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/2792-518-0x0000000004D40000-0x0000000004D50000-memory.dmp

Filesize
64KB

Download
memory/2792-193-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3000-995-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3000-2291-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/3164-1733-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3180-1380-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3180-2347-0x0000000005460000-0x0000000005470000-memory.dmp

Filesize
64KB

Download
memory/3336-1591-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3408-1682-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3412-569-0x0000000004C60000-0x0000000004C70000-memory.dmp

Filesize
64KB

Download
memory/3412-502-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3540-1500-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3560-624-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3732-1743-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3872-1988-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/3988-864-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4180-1221-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4236-1153-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4344-110-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4388-570-0x0000000004D60000-0x0000000004D70000-memory.dmp

Filesize
64KB

Download
memory/4388-138-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4392-513-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4576-1406-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4576-2164-0x0000000005140000-0x0000000005150000-memory.dmp

Filesize
64KB

Download
memory/4660-377-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4736-1120-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4804-1642-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4920-2475-0x0000000005110000-0x0000000005120000-memory.dmp

Filesize
64KB

Download
memory/4920-1248-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4992-957-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/4992-2379-0x0000000005620000-0x0000000005630000-memory.dmp

Filesize
64KB

Download
memory/5024-1280-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/5048-1716-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/5064-0-0x0000000000240000-0x000000000024A000-memory.dmp

Filesize
40KB

Download
memory/5064-5-0x0000000004D90000-0x0000000004D9A000-memory.dmp

Filesize
40KB

Download
memory/5064-4-0x0000000004F30000-0x0000000004F40000-memory.dmp

Filesize
64KB

Download
memory/5064-3-0x0000000004CE0000-0x0000000004D72000-memory.dmp

Filesize
584KB

Download
memory/5064-2-0x0000000005360000-0x0000000005906000-memory.dmp

Filesize
5.6MB

Download
memory/5064-1-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/5184-2471-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download
memory/5408-2134-0x0000000074530000-0x0000000074CE1000-memory.dmp

Filesize
7.7MB

Download