asyncrat | 7f5efb9dbd99c1fca3ebe59c5c38aacb9721d757671aee350a0a2107c41a2df7

Windows Service

T1543.003

Disable or Modify Tools

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Windows security bypass 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe = "0"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Oracle\VirtualBox Guest Additions	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2832 powershell.exe
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools 8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\VMware, Inc.\VMware Tools	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Executes dropped EXE 64 IoCs

Processes:

DD8989123MD.exeK8MN9DA.exeLunaInjector.exeSHA90123M17.exeK8MN9DA.exeK8MN9DA.exeDD8989123MD.exeDD8989123MD.exeDD8989123MD.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exeSHA90123M17.exe

pid	process
1552	DD8989123MD.exe
3060	K8MN9DA.exe
1004	LunaInjector.exe
2924	SHA90123M17.exe
2088	K8MN9DA.exe
1712	K8MN9DA.exe
1764	DD8989123MD.exe
2492	DD8989123MD.exe
1676	DD8989123MD.exe
3028	SHA90123M17.exe
1256	SHA90123M17.exe
2476	SHA90123M17.exe
1984	SHA90123M17.exe
3040	SHA90123M17.exe
2204	SHA90123M17.exe
992	SHA90123M17.exe
2200	SHA90123M17.exe
876	SHA90123M17.exe
1560	SHA90123M17.exe
1416	SHA90123M17.exe
1548	SHA90123M17.exe
1076	SHA90123M17.exe
1520	SHA90123M17.exe
1512	SHA90123M17.exe
1048	SHA90123M17.exe
2440	SHA90123M17.exe
1828	SHA90123M17.exe
872	SHA90123M17.exe
2792	SHA90123M17.exe
2664	SHA90123M17.exe
2568	SHA90123M17.exe
2968	SHA90123M17.exe
2132	SHA90123M17.exe
2984	SHA90123M17.exe
2296	SHA90123M17.exe
2728	SHA90123M17.exe
2848	SHA90123M17.exe
2104	SHA90123M17.exe
2832	SHA90123M17.exe
2560	SHA90123M17.exe
2592	SHA90123M17.exe
2552	SHA90123M17.exe
2556	SHA90123M17.exe
2868	SHA90123M17.exe
2660	SHA90123M17.exe
1124	SHA90123M17.exe
1392	SHA90123M17.exe
2768	SHA90123M17.exe
1248	SHA90123M17.exe
2116	SHA90123M17.exe
2080	SHA90123M17.exe
2228	SHA90123M17.exe
1728	SHA90123M17.exe
2096	SHA90123M17.exe
2940	SHA90123M17.exe
1940	SHA90123M17.exe
1684	SHA90123M17.exe
2956	SHA90123M17.exe
2748	SHA90123M17.exe
3044	SHA90123M17.exe
1924	SHA90123M17.exe
2400	SHA90123M17.exe
2404	SHA90123M17.exe
2776	SHA90123M17.exe

Loads dropped DLL 64 IoCs

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeK8MN9DA.exeDD8989123MD.exeWerFault.exeSHA90123M17.exe

pid	process
2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe
1456	WerFault.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe

Windows security modification 2 TTPs 8 IoCs

evasion trojan

Disable or Modify Tools

Modify Registry

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe = "0"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Spynet\SubmitSamplesConsent = "0"	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

5 pastebin.com
4 pastebin.com
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

7 wtfismyip.com
8 wtfismyip.com

flow	ioc
5	pastebin.com
4	pastebin.com

flow	ioc
7	wtfismyip.com
8	wtfismyip.com

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

pid	process
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
12412
12412
12412
12412
12412
12412
12412

Suspicious use of SetThreadContext 4 IoCs

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeK8MN9DA.exeDD8989123MD.exeDD8989123MD.exe

description	pid	process	target process
PID 2632 set thread context of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 3060 set thread context of 2088	3060	K8MN9DA.exe	K8MN9DA.exe
PID 1552 set thread context of 1676	1552	DD8989123MD.exe	DD8989123MD.exe
PID 1676 set thread context of 32100	1676	DD8989123MD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exe

pid	pid_target	process	target process
1672	2632	WerFault.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
1456	1552	WerFault.exe	DD8989123MD.exe
39512	32100

System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

K8MN9DA.exe8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeDD8989123MD.execmd.exeDD8989123MD.execmd.exetimeout.exepowershell.execmd.exeLunaInjector.execmd.exeK8MN9DA.exeSHA90123M17.exetimeout.execmd.exetimeout.execmd.exetimeout.exetimeout.exeschtasks.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K8MN9DA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD8989123MD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD8989123MD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LunaInjector.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	K8MN9DA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SHA90123M17.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Delays execution with timeout.exe 6 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

676 timeout.exe
1928 timeout.exe
7236 timeout.exe
12732
2592 timeout.exe
2052 timeout.exe
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exe

pid process

7228 schtasks.exe

pid	process
676	timeout.exe
1928	timeout.exe
7236	timeout.exe
12732
2592	timeout.exe
2052	timeout.exe

pid	process
7228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

powershell.exe8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exe

pid	process
2832	powershell.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
3060	K8MN9DA.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
1552	DD8989123MD.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe
2924	SHA90123M17.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exepowershell.exeK8MN9DA.exeDD8989123MD.exeSHA90123M17.exeK8MN9DA.exeDD8989123MD.exe

description	pid	process
Token: SeDebugPrivilege	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
Token: SeDebugPrivilege	2832	powershell.exe
Token: SeDebugPrivilege	3060	K8MN9DA.exe
Token: SeDebugPrivilege	1552	DD8989123MD.exe
Token: SeDebugPrivilege	2924	SHA90123M17.exe
Token: SeDebugPrivilege	2088	K8MN9DA.exe
Token: SeDebugPrivilege	12412
Token: SeDebugPrivilege	1676	DD8989123MD.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.execmd.exe8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exeK8MN9DA.exeDD8989123MD.exeLunaInjector.execmd.execmd.execmd.exe

description	pid	process	target process
PID 2632 wrote to memory of 2832	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	powershell.exe
PID 2632 wrote to memory of 2832	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	powershell.exe
PID 2632 wrote to memory of 2832	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	powershell.exe
PID 2632 wrote to memory of 2832	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	powershell.exe
PID 2632 wrote to memory of 2536	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	cmd.exe
PID 2632 wrote to memory of 2536	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	cmd.exe
PID 2632 wrote to memory of 2536	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	cmd.exe
PID 2632 wrote to memory of 2536	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	cmd.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	timeout.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	timeout.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	timeout.exe
PID 2536 wrote to memory of 2592	2536	cmd.exe	timeout.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 2612	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
PID 2632 wrote to memory of 1672	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	WerFault.exe
PID 2632 wrote to memory of 1672	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	WerFault.exe
PID 2632 wrote to memory of 1672	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	WerFault.exe
PID 2632 wrote to memory of 1672	2632	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	WerFault.exe
PID 2612 wrote to memory of 1552	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	DD8989123MD.exe
PID 2612 wrote to memory of 1552	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	DD8989123MD.exe
PID 2612 wrote to memory of 1552	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	DD8989123MD.exe
PID 2612 wrote to memory of 1552	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	DD8989123MD.exe
PID 2612 wrote to memory of 3060	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	K8MN9DA.exe
PID 2612 wrote to memory of 3060	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	K8MN9DA.exe
PID 2612 wrote to memory of 3060	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	K8MN9DA.exe
PID 2612 wrote to memory of 3060	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	K8MN9DA.exe
PID 2612 wrote to memory of 1004	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	LunaInjector.exe
PID 2612 wrote to memory of 1004	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	LunaInjector.exe
PID 2612 wrote to memory of 1004	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	LunaInjector.exe
PID 2612 wrote to memory of 1004	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	LunaInjector.exe
PID 3060 wrote to memory of 2716	3060	K8MN9DA.exe	cmd.exe
PID 3060 wrote to memory of 2716	3060	K8MN9DA.exe	cmd.exe
PID 3060 wrote to memory of 2716	3060	K8MN9DA.exe	cmd.exe
PID 3060 wrote to memory of 2716	3060	K8MN9DA.exe	cmd.exe
PID 1552 wrote to memory of 2740	1552	DD8989123MD.exe	SHA90123M17.exe
PID 1552 wrote to memory of 2740	1552	DD8989123MD.exe	SHA90123M17.exe
PID 1552 wrote to memory of 2740	1552	DD8989123MD.exe	SHA90123M17.exe
PID 1552 wrote to memory of 2740	1552	DD8989123MD.exe	SHA90123M17.exe
PID 1004 wrote to memory of 984	1004	LunaInjector.exe	cmd.exe
PID 1004 wrote to memory of 984	1004	LunaInjector.exe	cmd.exe
PID 1004 wrote to memory of 984	1004	LunaInjector.exe	cmd.exe
PID 1004 wrote to memory of 984	1004	LunaInjector.exe	cmd.exe
PID 2716 wrote to memory of 2052	2716	cmd.exe	timeout.exe
PID 2716 wrote to memory of 2052	2716	cmd.exe	timeout.exe
PID 2716 wrote to memory of 2052	2716	cmd.exe	timeout.exe
PID 2716 wrote to memory of 2052	2716	cmd.exe	timeout.exe
PID 2612 wrote to memory of 2924	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	SHA90123M17.exe
PID 2612 wrote to memory of 2924	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	SHA90123M17.exe
PID 2612 wrote to memory of 2924	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	SHA90123M17.exe
PID 2612 wrote to memory of 2924	2612	8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe	SHA90123M17.exe
PID 984 wrote to memory of 556	984	cmd.exe	SHA90123M17.exe
PID 984 wrote to memory of 556	984	cmd.exe	SHA90123M17.exe
PID 984 wrote to memory of 556	984	cmd.exe	SHA90123M17.exe
PID 2740 wrote to memory of 676	2740	cmd.exe	timeout.exe
PID 2740 wrote to memory of 676	2740	cmd.exe	timeout.exe
PID 2740 wrote to memory of 676	2740	cmd.exe	timeout.exe
PID 2740 wrote to memory of 676	2740	cmd.exe	timeout.exe

C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security bypass
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe" -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2832
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 1
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\SysWOW64\timeout.exe
    timeout 1
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:2592
- C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\8bd3bff5e679f6b14e42d7b66aa8497f_JaffaCakes118.exe"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
    "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2740
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:676
  - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
      "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
      4⤵
      Executes dropped EXE
      PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
      "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe
      "C:\Users\Admin\AppData\Local\Temp\DD8989123MD.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1676
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1552 -s 904
      4⤵
      Loads dropped DLL
      Program crash
      PID:1456
- - C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
    "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3060
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2716
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
      "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe
      "C:\Users\Admin\AppData\Local\Temp\K8MN9DA.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2088
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"' & exit
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7148
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "ZxKKE4oK8" /tr '"C:\Users\Admin\AppData\Local\Temp\ZxKKE4oK8.exe"'
        6⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:7228
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp18CE.tmp.bat""
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout 3
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7236
- - C:\Users\Admin\AppData\Roaming\LunaInjector.exe
    "C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\770.tmp\771.tmp\772.bat C:\Users\Admin\AppData\Roaming\LunaInjector.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\system32\chcp.com
        
        chcp 65001
        5⤵
        
        PID:556
    - - C:\Windows\system32\mode.com
        
        mode 82,24
        5⤵
        
        PID:2024
- - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
    "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2924
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout 1
      4⤵
      System Location Discovery: System Language Discovery
      PID:1172
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout 1
        5⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:3028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1256
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:992
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:876
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1560
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2792
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2968
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2132
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2984
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2832
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2552
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1728
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:3044
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      Executes dropped EXE
      PID:2776
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:584
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2064
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:480
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2952
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1640
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3016
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2388
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3008
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:444
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:760
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:492
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:540
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1664
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1632
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:980
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3144
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3176
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3184
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3232
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3312
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3360
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3416
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3456
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3464
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3472
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3536
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3544
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3552
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3592
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3656
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3664
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3672
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3688
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3816
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3832
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3840
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3856
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3864
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3888
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3992
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4048
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4056
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4072
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4108
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4140
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4172
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4180
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4196
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4236
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4412
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4460
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4492
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4580
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4652
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4852
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4900
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4924
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5004
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5140
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5164
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5284
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5372
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5428
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5484
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5516
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5900
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5916
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5948
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5972
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7088
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:6200
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1304
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:568
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:904
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2376
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7104
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8196
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8252
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8300
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8324
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8332
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8340
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8372
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8428
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8468
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8492
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8500
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8524
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8540
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8572
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8612
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8620
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8700
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8708
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8892
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8948
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8956
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8972
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9060
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9108
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9148
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9164
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9764
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe
      "C:\Users\Admin\AppData\Local\Temp\SHA90123M17.exe"
      4⤵
      PID:9876
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2632 -s 1792
  2⤵
  - Program crash
  PID:1672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry