modiloader | 9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 01:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe
Size

1.1MB
MD5

b11bbc6c3ae4709fa22dd8d9a33bfeac
SHA1

fcbda98feb1d419e0a34b7cb048952a83517e6a3
SHA256

9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7
SHA512

332afde29fab387fc0bb3036d77aacd80dfb2f75d466e9e882ea3ea499f36282dff668cb0e3d000c7ec79bf8c7cdef1ac472b652e24ab070d6cafa0f91bc6c93
SSDEEP

24576:Rw/vqi/VUNCMyv976OS3Aq3BT6nbvNox4vrY1rbpps8Gs:Rw7VDLXSwsBT6nbVols8Gs

Score

10^/10

modiloader discovery persistence trojan

Malware Config

Signatures

ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
trojan modiloader

ModiLoader Second Stage 61 IoCs

resource	yara_rule
behavioral2/memory/756-2-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-8-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-13-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-21-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-39-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-38-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-34-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-66-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-33-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-64-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-32-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-57-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-30-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-65-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-63-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-62-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-61-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-60-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-59-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-58-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-56-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-55-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-53-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-52-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-51-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-50-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-49-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-48-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-46-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-45-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-44-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-43-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-42-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-54-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-29-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-28-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-27-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-47-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-23-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-22-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-41-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-40-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-37-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-36-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-35-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-31-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-17-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-16-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-15-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-26-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-25-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-14-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-24-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-12-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-20-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-19-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-18-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-11-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-10-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-9-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2
behavioral2/memory/756-7-0x0000000002A50000-0x0000000003A50000-memory.dmp	modiloader_stage2

Executes dropped EXE 9 IoCs

pid	Process
396	alpha.pif
100	alpha.pif
2608	alpha.pif
808	xpha.pif
4368	per.exe
2544	pha.pif
1652	alpha.pif
2988	alpha.pif
1316	alpha.pif

Loads dropped DLL 1 IoCs

pid	Process
4368	per.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Anncarsb = "C:\\Users\\Public\\Anncarsb.url"	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	drive.google.com
25	drive.google.com

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SndVol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2172	esentutl.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	25	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	29	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	pha.pif
2544	pha.pif

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe
3492	SndVol.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	pha.pif

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3492	SndVol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 1184	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	95
PID 756 wrote to memory of 1184	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	95
PID 756 wrote to memory of 1184	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	95
PID 1184 wrote to memory of 2612	1184	cmd.exe	97
PID 1184 wrote to memory of 2612	1184	cmd.exe	97
PID 1184 wrote to memory of 2612	1184	cmd.exe	97
PID 1184 wrote to memory of 2172	1184	cmd.exe	98
PID 1184 wrote to memory of 2172	1184	cmd.exe	98
PID 1184 wrote to memory of 2172	1184	cmd.exe	98
PID 1184 wrote to memory of 396	1184	cmd.exe	99
PID 1184 wrote to memory of 396	1184	cmd.exe	99
PID 1184 wrote to memory of 396	1184	cmd.exe	99
PID 1184 wrote to memory of 100	1184	cmd.exe	100
PID 1184 wrote to memory of 100	1184	cmd.exe	100
PID 1184 wrote to memory of 100	1184	cmd.exe	100
PID 1184 wrote to memory of 2608	1184	cmd.exe	101
PID 1184 wrote to memory of 2608	1184	cmd.exe	101
PID 1184 wrote to memory of 2608	1184	cmd.exe	101
PID 2608 wrote to memory of 808	2608	alpha.pif	102
PID 2608 wrote to memory of 808	2608	alpha.pif	102
PID 2608 wrote to memory of 808	2608	alpha.pif	102
PID 1184 wrote to memory of 4368	1184	cmd.exe	106
PID 1184 wrote to memory of 4368	1184	cmd.exe	106
PID 4368 wrote to memory of 5116	4368	per.exe	107
PID 4368 wrote to memory of 5116	4368	per.exe	107
PID 4368 wrote to memory of 2544	4368	per.exe	109
PID 4368 wrote to memory of 2544	4368	per.exe	109
PID 1184 wrote to memory of 1652	1184	cmd.exe	111
PID 1184 wrote to memory of 1652	1184	cmd.exe	111
PID 1184 wrote to memory of 1652	1184	cmd.exe	111
PID 1184 wrote to memory of 2988	1184	cmd.exe	112
PID 1184 wrote to memory of 2988	1184	cmd.exe	112
PID 1184 wrote to memory of 2988	1184	cmd.exe	112
PID 1184 wrote to memory of 1316	1184	cmd.exe	113
PID 1184 wrote to memory of 1316	1184	cmd.exe	113
PID 1184 wrote to memory of 1316	1184	cmd.exe	113
PID 756 wrote to memory of 1556	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	114
PID 756 wrote to memory of 1556	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	114
PID 756 wrote to memory of 1556	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	114
PID 756 wrote to memory of 3492	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	115
PID 756 wrote to memory of 3492	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	115
PID 756 wrote to memory of 3492	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	115
PID 756 wrote to memory of 3492	756	9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe	115
PID 3492 wrote to memory of 4416	3492	SndVol.exe	117
PID 3492 wrote to memory of 4416	3492	SndVol.exe	117
PID 3492 wrote to memory of 4416	3492	SndVol.exe	117
PID 3492 wrote to memory of 2512	3492	SndVol.exe	118
PID 3492 wrote to memory of 2512	3492	SndVol.exe	118
PID 3492 wrote to memory of 2512	3492	SndVol.exe	118
PID 3492 wrote to memory of 3228	3492	SndVol.exe	119
PID 3492 wrote to memory of 3228	3492	SndVol.exe	119
PID 3492 wrote to memory of 3228	3492	SndVol.exe	119
PID 3492 wrote to memory of 2076	3492	SndVol.exe	120
PID 3492 wrote to memory of 2076	3492	SndVol.exe	120
PID 3492 wrote to memory of 2076	3492	SndVol.exe	120
PID 3492 wrote to memory of 1824	3492	SndVol.exe	121
PID 3492 wrote to memory of 1824	3492	SndVol.exe	121
PID 3492 wrote to memory of 1824	3492	SndVol.exe	121
PID 3492 wrote to memory of 3708	3492	SndVol.exe	122
PID 3492 wrote to memory of 3708	3492	SndVol.exe	122
PID 3492 wrote to memory of 3708	3492	SndVol.exe	122
PID 3492 wrote to memory of 3356	3492	SndVol.exe	123
PID 3492 wrote to memory of 3356	3492	SndVol.exe	123
PID 3492 wrote to memory of 3356	3492	SndVol.exe	123

C:\Users\Admin\AppData\Local\Temp\9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe
"C:\Users\Admin\AppData\Local\Temp\9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\bsracnnA.cmd" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\SysWOW64\esentutl.exe
    C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\esentutl.exe
    C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    PID:2172
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:396
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:100
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Users\Public\xpha.pif
      C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:808
- - C:\Windows \SysWOW64\per.exe
    "C:\\Windows \\SysWOW64\\per.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4368
  - - C:\Windows\SYSTEM32\esentutl.exe
      esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
      4⤵
      PID:5116
  - - C:\Users\Public\pha.pif
      C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionExtension '.exe','bat','.pif'
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2544
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1652
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2988
- - C:\Users\Public\alpha.pif
    C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1316
- C:\Windows\SysWOW64\esentutl.exe
  C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\9a045c9c991d1d135687931fd936236135a9d812a9b1029284114a661f44a2a7.exe /d C:\\Users\\Public\\Libraries\\Anncarsb.PIF /o
  2⤵
  PID:1556
- C:\Windows\SysWOW64\SndVol.exe
  C:\Windows\System32\SndVol.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2512
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1824
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3356
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2920
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2320
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:892
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:736
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4460
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3808
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3084
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5068
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3100
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1052
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1336
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4884
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:384
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4192
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3616
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1428
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2916
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3316
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3660
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:232
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:440
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3776
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2496
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3932
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3376
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4656
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2380
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3172
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:636
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2748
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3468
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2268
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1632
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4168
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3456
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3996
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4600
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3656
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1680
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1580
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:988
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1952
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3292
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3916
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1712
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1184
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1768
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1624
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2596
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1324
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:680
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1436
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3528
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4876
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3488
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1032
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:628
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3392
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4504
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2288
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1056
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1864
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:928
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4252
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4980
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2724
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3360
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4076
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3124
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2792
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1728
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4212
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3852
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1968
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1396
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2116
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2156
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4160
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4300
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2148
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2052
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1800
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2376
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2244
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4480
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1860
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:100
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4868
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3600
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5116
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2612
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:764
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4360
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3416
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1480
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4368
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:548
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2504
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1652
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4068
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2988
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:868
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1980
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1556
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:1520
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4812
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3856
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:452
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:2332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5128
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5136
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5144
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5152
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5160
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5168
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5176
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5184
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5192
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5208
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5216
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5224
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5232
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5240
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5248
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5256
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5264
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5272
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5280
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5288
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5296
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5304
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5312
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5320
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5336
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5344
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5352
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5360
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5368
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5376
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5400
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5408
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5416
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5424
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5440
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5448
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5456
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5464
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5472
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5480
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5488
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5504
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5512
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5520
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5528
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5544
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5552
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5560
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5568
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5576
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5584
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5592
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5600
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5608
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5616
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5624
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5632
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5640
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5656
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5664
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5672
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5688
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5696
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5704
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5712
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5720
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5728
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5744
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5752
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5760
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5768
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5776
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5784
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5792
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5800
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5808
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5824
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5832
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5840
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5848
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5856
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5864
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5872
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5880
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5904
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5912
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5920
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5928
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5936
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5944
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5952
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5960
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5968
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5976
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5984
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5992
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6000
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6008
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6016
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6024
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6032
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6040
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6048
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6056
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6072
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6080
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6088
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6096
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6104
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6120
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6128
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6136
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6148
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6156
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6164
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6172
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6180
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6188
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6196
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6204
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6212
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6220
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6244
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6252
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6260
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6268
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6276
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6292
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6300
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6308
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6316
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6324
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6340
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6356
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6364
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6372
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6380
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6388
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6396
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6404
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6428
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6436
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6444
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6452
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6460
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6468
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6476
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6500
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6508
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6516
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6524
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6532
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6540
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6548
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6556
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6564
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6580
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6588
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6596
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6604
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6612
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6620
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6628
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6636
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6644
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6652
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6660
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6668
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6684
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6700
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6716
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6724
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6748
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6756
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6764
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6772
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6780
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6788
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6804
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6812
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6820
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6828
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6836
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6844
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6852
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6860
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6868
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6876
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6884
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6892
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6900
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6908
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6916
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6924
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6932
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6940
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6948
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6956
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6964
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6972
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6980
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6988
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6996
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7004
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7012
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7020
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7028
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7036
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7044
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7052
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7060
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7068
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7076
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7084
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7092
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7100
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7108
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7116
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7124
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7132
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7140
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7148
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7156
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7164
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:6284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7096
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7172
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7180
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7188
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7196
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7204
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7212
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7220
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7244
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7252
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7260
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7268
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7276
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7292
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7300
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7308
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7316
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7324
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7340
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7356
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7364
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7372
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7380
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7388
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7396
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7404
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7428
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7436
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7444
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7452
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7460
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7468
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7476
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7500
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7508
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7516
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7524
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7532
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7540
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7548
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7556
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7564
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7580
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7588
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7596
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7604
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7612
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7620
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7628
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7636
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7644
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7652
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7660
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7668
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7684
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7700
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7716
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7724
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7748
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7756
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7764
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7772
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7780
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7788
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7800
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7808
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7816
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7824
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7832
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7840
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7848
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7856
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7864
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7872
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7880
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7904
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7912
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7920
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7928
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7936
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7944
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7952
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7960
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7968
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7976
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7984
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7992
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8000
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8008
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8016
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8024
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8032
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8040
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8048
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8056
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8072
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8080
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8088
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8096
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8104
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8112
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8120
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8128
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8136
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8144
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8152
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8160
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8168
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8176
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8184
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:3820
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:7888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8208
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8216
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8224
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8232
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8240
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8248
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8256
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8264
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8272
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8280
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8288
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8296
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8304
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8312
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8320
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8328
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8336
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8344
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8352
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8360
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8368
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8376
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8384
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8392
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8400
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8408
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8416
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8424
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8440
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8448
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8456
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8464
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8472
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8480
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8488
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8496
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8504
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8512
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8520
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8528
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8536
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8544
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8552
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8560
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8568
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8576
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8584
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8592
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8600
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8608
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8616
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8624
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8632
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8640
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8648
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8656
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8664
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8672
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8680
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8688
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8696
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8704
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8712
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8720
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8728
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8736
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8744
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8752
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8760
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8768
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8776
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8784
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8792
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8800
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8808
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8816
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8824
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8832
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8840
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8848
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8856
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8864
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8872
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8880
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8904
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8912
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8920
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8928
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8936
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8944
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8952
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8960
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8968
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8976
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8984
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8992
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9000
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9008
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9016
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9024
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9032
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9040
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9048
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9056
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9064
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9072
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9080
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9088
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9096
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9104
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9112
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9120
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9128
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9136
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9144
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9152
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9160
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9168
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9176
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9184
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9192
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9200
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9208
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:4140
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:8692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9220
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9244
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9252
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9260
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9268
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9276
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9292
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9300
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9308
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9316
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9324
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9340
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9356
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9364
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9372
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9380
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9388
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9396
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9404
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9428
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9436
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9444
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9452
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9460
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9468
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9476
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9500
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9508
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9516
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9524
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9532
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9540
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9548
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9556
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9564
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9580
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9588
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9596
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9604
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9612
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9620
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9628
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9636
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9644
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9652
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9660
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9668
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9684
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9700
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9716
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9724
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9748
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9756
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9764
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9772
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9780
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9788
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9804
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9812
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9820
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9828
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9836
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9844
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9852
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9860
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9868
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9876
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9884
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9892
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9900
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9908
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9916
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9924
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9932
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9940
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9948
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9956
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9964
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9972
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9980
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9988
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9996
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10004
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10012
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10020
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10028
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10036
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10044
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10052
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10060
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10068
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10076
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10084
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10092
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10100
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10108
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10116
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10124
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10132
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10140
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10148
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10156
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10164
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10172
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10180
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10188
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10196
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10204
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10212
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10220
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:9484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10248
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10256
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10264
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10272
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10280
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10288
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10296
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10304
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10312
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10320
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10328
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10336
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10344
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10352
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10360
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10368
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10376
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10384
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10392
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10400
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10432
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10440
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10448
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10456
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10464
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10472
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10480
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10488
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10496
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10504
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10512
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10520
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10528
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10536
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10544
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10552
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10560
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10568
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10576
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10584
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10592
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10600
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10608
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10616
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10624
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10632
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10640
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10648
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10656
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10664
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10672
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10680
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10688
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10696
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10704
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10712
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10720
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10728
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10736
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10744
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10752
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10760
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10768
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10776
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10784
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10792
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10800
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10808
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10816
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10824
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10832
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10840
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10848
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10856
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10864
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10872
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10880
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10888
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10896
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10904
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10912
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10920
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10928
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10936
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10944
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10952
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10960
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10968
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10976
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10984
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10992
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11000
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11008
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11020
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11028
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11036
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11044
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11052
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11060
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11068
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11076
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11084
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11092
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11100
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11108
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11116
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11124
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11132
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11140
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11148
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11156
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11164
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11172
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11180
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11188
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11196
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11204
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11212
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11220
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11228
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11236
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11244
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11252
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11260
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:10288
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11112
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11268
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11276
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11284
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11292
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11300
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11308
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11316
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11324
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11332
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11340
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11348
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11356
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11364
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11372
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11380
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11388
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11396
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11404
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11412
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11420
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11428
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11436
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11444
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11452
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11460
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11468
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11476
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11484
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11492
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11500
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11508
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11516
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11524
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11532
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11540
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11548
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11556
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11564
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11572
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11580
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11588
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11596
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11604
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11612
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11620
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11628
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11636
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11644
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11652
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11660
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11668
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11676
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11684
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11692
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11700
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11708
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11716
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11724
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11732
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11740
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11748
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11756
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11764
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11772
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11780
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11788
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11796
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11804
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11812
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11820
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11828
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11836
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11844
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11852
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11860
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11868
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11876
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\SysWOW64\SndVol.exe /stext "C:\Users\Admin\AppData\Local\Temp\lknkvveqvnobjefmjluddbzjukcdygktvt"
    3⤵
    PID:11884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\remcos\logs.dat

Filesize
144B

MD5
23352f4126619b9b5e7ea926cda224a7

SHA1
a0105ae9e9d4d83bbadd17b20f5783b652b0de11

SHA256
1fd7900e341a45d774aa7752aa4c0541cdce7b3c8c0d64fd5f5661df7c089b9b

SHA512
11753753d0be6a1ad3ea4e81b44504418ff17556f1f515ce6d894c52a8e621bd450bb97ab4954bc452acdef49a6ae71330899d1fc6795ff91fdecac8354baa7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ggm3c0ti.pak.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Public\Libraries\bsracnnA.cmd

Filesize
60KB

MD5
b87f096cbc25570329e2bb59fee57580

SHA1
d281d1bf37b4fb46f90973afc65eece3908532b2

SHA256
d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e

SHA512
72901adde38f50cf6d74743c0a546c0fea8b1cd4a18449048a0758a7593a176fc33aad1ebfd955775eefc2b30532bcc18e4f2964b3731b668dd87d94405951f7

Download Submit
C:\Users\Public\alpha.pif

Filesize
231KB

MD5
d0fce3afa6aa1d58ce9fa336cc2b675b

SHA1
4048488de6ba4bfef9edf103755519f1f762668f

SHA256
4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22

SHA512
80e127ef81752cd50f9ea2d662dc4d3bf8db8d29680e75fa5fc406ca22cafa5c4d89ef2eac65b486413d3cdd57a2c12a1cb75f65d1e312a717d262265736d1c2

Download Submit
C:\Users\Public\pha.pif

Filesize
442KB

MD5
04029e121a0cfa5991749937dd22a1d9

SHA1
f43d9bb316e30ae1a3494ac5b0624f6bea1bf054

SHA256
9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f

SHA512
6a2fb055473033fd8fdb8868823442875b5b60c115031aaeda688a35a092f6278e8687e2ae2b8dc097f8f3f35d23959757bf0c408274a2ef5f40ddfa4b5c851b

Download Submit
C:\Users\Public\xpha.pif

Filesize
18KB

MD5
b3624dd758ccecf93a1226cef252ca12

SHA1
fcf4dad8c4ad101504b1bf47cbbddbac36b558a7

SHA256
4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef

SHA512
c613d18511b00fa25fc7b1bdde10d96debb42a99b5aaab9e9826538d0e229085bb371f0197f6b1086c4f9c605f01e71287ffc5442f701a95d67c232a5f031838

Download Submit
C:\Windows \SysWOW64\NETUTILS.dll

Filesize
115KB

MD5
c5db31551cb21105e3f0b3e467b91cc7

SHA1
c66fd7732973d9803ba0fd4323e8507876892310

SHA256
3fa23d8f7b7eeac6443e107bd70d0c6371afc1f8082d3d58fffd8685cf9e2193

SHA512
6d1ee4b55fb74dc093f52caf1e093ec2742af263ff8fa264cd61eea48c021c3438150ba12a8e9d694e7246fe296ea011d8b6313e8ee4476a63c7072c2990685e

Download Submit
C:\Windows \SysWOW64\per.exe

Filesize
94KB

MD5
869640d0a3f838694ab4dfea9e2f544d

SHA1
bdc42b280446ba53624ff23f314aadb861566832

SHA256
0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323

SHA512
6e775cfb350415434b18427d5ff79b930ed3b0b3fc3466bc195a796c95661d4696f2d662dd0e020c3a6c3419c2734468b1d7546712ecec868d2bbfd2bc2468a7

Download Submit
memory/756-48-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-30-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-8-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-13-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-21-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-39-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-38-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-34-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-66-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-33-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-64-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-32-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-57-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-42-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-65-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-63-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-62-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-61-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-60-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-59-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-58-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-56-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-55-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-53-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-52-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-51-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-50-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-49-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-5-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/756-46-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-54-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-44-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-27-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-4-0x0000000000400000-0x0000000000521000-memory.dmp

Filesize
1.1MB

Download
memory/756-45-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-29-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-28-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-43-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-47-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-23-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-22-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-41-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-40-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-37-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-36-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-35-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-31-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-17-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-16-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-15-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-26-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-25-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-14-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-24-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-12-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-20-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-19-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-2-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-18-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-11-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-10-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-9-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-7-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/756-0-0x0000000000610000-0x0000000000611000-memory.dmp

Filesize
4KB

Download
memory/756-1-0x0000000002A50000-0x0000000003A50000-memory.dmp

Filesize
16.0MB

Download
memory/2544-311-0x000002CFE2A00000-0x000002CFE2A22000-memory.dmp

Filesize
136KB

Download