4a650668498f5194253971caae89c99a780b78cf82a812350bb8d17f12909991

Analysis

max time kernel
120s
max time network
78s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

be35290b13ce62bdec0fe535d89688b0N.exe
Size

815KB
MD5

be35290b13ce62bdec0fe535d89688b0
SHA1

2e64ac4545ae8259762a9dc37390fde7bce6f7ba
SHA256

4a650668498f5194253971caae89c99a780b78cf82a812350bb8d17f12909991
SHA512

a94e48c6a3436bb48a44d6a58bb8526444983362cf6d647b1f727a2f6cdff204ebb33f1a17b562630b10bd027362929b22da72f3efef653fc6806333111d02f4
SSDEEP

24576:bSLW+oGl6kbfjgcog/FS6+7xZ2R8hyIGBeSuRG:belDsc/doxZ2R8hiz

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	be35290b13ce62bdec0fe535d89688b0N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	be35290b13ce62bdec0fe535d89688b0N.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4932-0-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/files/0x000900000002344a-5.dat	upx
behavioral2/memory/2220-9-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/1492-12-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4356-13-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3900-16-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3160-15-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2668-17-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/408-18-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2104-34-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5116-37-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4836-36-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2324-35-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3132-42-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4932-41-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3356-44-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/336-43-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/732-47-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2220-45-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3964-53-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4356-52-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/1492-51-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3692-57-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2668-64-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3900-56-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3160-55-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/408-66-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2740-70-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2104-69-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2324-79-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5116-81-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/336-91-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3132-88-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4836-80-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3988-92-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3356-97-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3304-124-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3964-123-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/1776-146-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3692-143-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3696-153-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/2740-160-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5508-184-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5748-201-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5740-200-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/1776-199-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/636-192-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3304-191-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5492-183-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5292-169-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5272-167-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/4816-166-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3796-205-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5192-219-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/6160-237-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5292-239-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/6148-236-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5788-235-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/3704-234-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5272-233-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/6620-270-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/6548-269-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5508-268-0x0000000000400000-0x000000000041D000-memory.dmp	upx
behavioral2/memory/5500-267-0x0000000000400000-0x000000000041D000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\mssrv32 = "C:\\Windows\\mssrv.exe"	be35290b13ce62bdec0fe535d89688b0N.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\S:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\T:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\W:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\Z:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\B:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\I:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\N:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\R:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\K:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\L:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\V:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\X:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\Q:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\U:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\G:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\H:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\J:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\M:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\O:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\Y:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\A:	be35290b13ce62bdec0fe535d89688b0N.exe
File opened (read-only)	\??\E:	be35290b13ce62bdec0fe535d89688b0N.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\brasilian porn trambling public feet .mpeg.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft SQL Server\130\Shared\spanish trambling hidden feet .mpg.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\Updates\Download\lesbian several models cock .mpeg.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Windows Sidebar\Shared Gadgets\xxx [bangbus] .zip.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\Images\PrintAndShare\black action gay [bangbus] (Liz).rar.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\dotnet\shared\lesbian hot (!) titts lady .zip.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\root\Templates\russian action beast full movie hole .mpeg.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gay public .mpeg.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\black handjob horse hot (!) swallow .zip.exe	be35290b13ce62bdec0fe535d89688b0N.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\130\Shared\italian action hardcore public feet \Û (Sylvia).zip.exe	be35290b13ce62bdec0fe535d89688b0N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\mssrv.exe	be35290b13ce62bdec0fe535d89688b0N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be35290b13ce62bdec0fe535d89688b0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be35290b13ce62bdec0fe535d89688b0N.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4932	be35290b13ce62bdec0fe535d89688b0N.exe
4932	be35290b13ce62bdec0fe535d89688b0N.exe
2220	be35290b13ce62bdec0fe535d89688b0N.exe
2220	be35290b13ce62bdec0fe535d89688b0N.exe
4932	be35290b13ce62bdec0fe535d89688b0N.exe
4932	be35290b13ce62bdec0fe535d89688b0N.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2220	4932	be35290b13ce62bdec0fe535d89688b0N.exe	87
PID 4932 wrote to memory of 2220	4932	be35290b13ce62bdec0fe535d89688b0N.exe	87
PID 4932 wrote to memory of 2220	4932	be35290b13ce62bdec0fe535d89688b0N.exe	87
PID 2220 wrote to memory of 1492	2220	be35290b13ce62bdec0fe535d89688b0N.exe	88
PID 2220 wrote to memory of 1492	2220	be35290b13ce62bdec0fe535d89688b0N.exe	88
PID 2220 wrote to memory of 1492	2220	be35290b13ce62bdec0fe535d89688b0N.exe	88
PID 4932 wrote to memory of 4356	4932	be35290b13ce62bdec0fe535d89688b0N.exe	89
PID 4932 wrote to memory of 4356	4932	be35290b13ce62bdec0fe535d89688b0N.exe	89
PID 4932 wrote to memory of 4356	4932	be35290b13ce62bdec0fe535d89688b0N.exe	89

C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
"C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13524
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14124
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12980
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:18300
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:18052
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3568
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12992
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:13696
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13556
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12808
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:17916
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:13540
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:15072
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:9448
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:12856
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:18216
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:4356
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:2668
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:17924
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        7⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17908
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15952
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:1468
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:12708
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17288
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:452
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:15792
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15176
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:1524
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:14340
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:16136
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:14980
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7544
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12648
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10244
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:4052
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:13664
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:9900
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:12496
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:3900
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:336
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:17628
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        6⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11776
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:4968
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:16344
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:13440
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12448
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:17588
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:1984
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:17036
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:7188
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:2056
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:2324
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:14296
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
        5⤵
        
        PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10436
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:432
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:13100
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:15396
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:10456
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:14780
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:12816
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:18152
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:16580
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:11156
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:2248
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:5132
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
      "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
      4⤵
      PID:14004
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:13364
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:6064
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:9816
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:14200
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:7496
- - C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
    "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
    3⤵
    PID:14020
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:9716
- C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe
  "C:\Users\Admin\AppData\Local\Temp\be35290b13ce62bdec0fe535d89688b0N.exe"
  2⤵
  PID:13300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\gay public .mpeg.exe

Filesize
315KB

MD5
70ee27aeb8afc6ef8adb14cee1af93c0

SHA1
0ee9fd6f050d687d0305b44862fc4ed86af96b64

SHA256
858c8f735364d29d32e2554baf66ecb210fc5f745f00e5075179fe9d12761680

SHA512
a145b0dc6a5ad2429b940b1244a4373a8c331ce1a1d6972494166e3d468a0d03e621eed2dfc034e5d6926d47faca54b55048920c2e6b65c147d8de0ed027f151

Download Submit
memory/336-91-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/336-43-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/408-66-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/408-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/636-192-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/732-47-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1492-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1492-51-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-146-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1776-199-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2104-34-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2104-69-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2220-45-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2220-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2324-35-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2324-79-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2668-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2668-64-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2740-160-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2740-70-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3132-42-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3132-88-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3160-55-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3160-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3304-191-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3304-124-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3356-44-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3356-97-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3692-143-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3692-57-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3696-153-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3704-234-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3796-205-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3900-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3900-56-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3964-53-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3964-123-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3988-92-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4356-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4356-52-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4816-166-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4836-80-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4836-36-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4932-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4932-41-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5116-81-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5116-37-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5192-219-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5272-233-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5272-167-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5292-169-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5292-239-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5492-183-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5500-267-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5508-184-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5508-268-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5592-271-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5740-279-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5740-200-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5748-280-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5748-201-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/5788-235-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6072-289-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6148-309-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6148-236-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6160-310-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6160-237-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6548-269-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6620-270-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6776-320-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6796-272-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6796-321-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6804-273-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6804-322-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6812-274-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6812-323-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/6908-281-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7032-335-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7032-311-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7068-285-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7076-324-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7076-290-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7100-291-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7120-325-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7120-292-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7128-326-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7128-293-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7348-336-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7628-342-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/7784-351-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8028-329-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8036-330-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8052-332-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8148-333-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8400-343-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/8792-352-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download