be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2

Analysis

max time kernel
24s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Size 4.8MB
Sample241022-e62fvszcqj
SHA256 be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2
MD5 4d09a67b1d1aef7dc9f944a617c32eb0
SHA1 1c98026c29ed9a6cb58bbdc7a75bee0d50bda541
SHA512 cf05660b77618531eccb4f122b74d11750a78f75602b3325c555b47fd7f145d971b30964f5b102cbcb9e2466f54fd9592eef2d9300e2ee872edafb162c7e185e
SSDEEP 98304:Ot5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:OAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe

Program crash 64 IoCs

pid	pid_target	Process	procid_target
6444	5556	WerFault.exe	209
7020	5504	WerFault.exe	206
6604	5504	WerFault.exe	206
6664	5556	WerFault.exe	209
8968	5524	WerFault.exe	207
10964	5576	WerFault.exe	210
10740	5540	WerFault.exe	208
10236	5608	WerFault.exe	211
9628	5480	WerFault.exe	205
10744	8560	WerFault.exe	384
10972	5576	WerFault.exe	210
10084	8764	WerFault.exe	393
11052	5416	WerFault.exe	201
10732	644	WerFault.exe	127
11112	5432	WerFault.exe	202
9532	4396	WerFault.exe	174
11252	1372	WerFault.exe	106
10792	2380	WerFault.exe	112
10048	5416	WerFault.exe	201
10628	232	WerFault.exe	124
8308	904	WerFault.exe	142
7876	3100	WerFault.exe	255
9796	6200	WerFault.exe	254
9532	5624	WerFault.exe	212
9896	6460	WerFault.exe	264
9308	3100	WerFault.exe	255
7288	4612	WerFault.exe	165
10176	5060	WerFault.exe	107
9088	1800	WerFault.exe	104
6224	4816	WerFault.exe	92
9880	1376	WerFault.exe	83
4480	1936	WerFault.exe	85
2392	3916	WerFault.exe	90
7736	1088	WerFault.exe	148
3628	3364	WerFault.exe	154
9964	10696	WerFault.exe	479
1456	1208	WerFault.exe	177
3444	9012	WerFault.exe	400
9596	4288	WerFault.exe	159
2436	9048	WerFault.exe	403
4500	5176	WerFault.exe	189
4856	2196	WerFault.exe	157
6540	10596	WerFault.exe	450
8732	4976	WerFault.exe	116
8352	7148	WerFault.exe	280
9528	7372	WerFault.exe	279
8964	7228	WerFault.exe	281
7968	2196	WerFault.exe	157
5868	7640	WerFault.exe	781
9424	11212	WerFault.exe	523
7408	10304	WerFault.exe	534
6232	1912	WerFault.exe	171
6480	8596	WerFault.exe	386
2932	2812	WerFault.exe	89
2120	6152	WerFault.exe	672
4956	5204	WerFault.exe	190
11196	9376	WerFault.exe	468
3844	1912	WerFault.exe	171
2572	6324	WerFault.exe	263
5380	4356	WerFault.exe	125
6240	4844	WerFault.exe	126
3108	8148	WerFault.exe	337
1404	3476	Process not Found	818
9156	10116	Process not Found	581

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1376	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1376	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
744	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
744	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1936	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1936	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3576	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3576	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4028	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4028	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2696	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2696	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3916	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3916	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1780	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1780	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4816	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4816	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5112	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5112	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
520	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
520	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1340	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1340	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1964	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1964	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2560	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2560	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4036	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4036	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2988	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2988	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2976	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2976	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
636	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
636	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3860	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3860	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1800	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1800	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5024	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5024	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1372	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
1372	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5060	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
5060	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3948	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3948	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
412	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
412	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
212	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
212	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4380	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4380	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2380	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
2380	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3108	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
3108	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4088	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
4088	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 744	1376	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	84
PID 1376 wrote to memory of 744	1376	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	84
PID 1376 wrote to memory of 744	1376	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	84
PID 744 wrote to memory of 1936	744	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	85
PID 744 wrote to memory of 1936	744	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	85
PID 744 wrote to memory of 1936	744	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	85
PID 1936 wrote to memory of 3576	1936	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	86
PID 1936 wrote to memory of 3576	1936	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	86
PID 1936 wrote to memory of 3576	1936	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	86
PID 3576 wrote to memory of 4028	3576	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	87
PID 3576 wrote to memory of 4028	3576	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	87
PID 3576 wrote to memory of 4028	3576	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	87
PID 4028 wrote to memory of 2696	4028	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	88
PID 4028 wrote to memory of 2696	4028	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	88
PID 4028 wrote to memory of 2696	4028	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	88
PID 2696 wrote to memory of 2812	2696	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	89
PID 2696 wrote to memory of 2812	2696	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	89
PID 2696 wrote to memory of 2812	2696	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	89
PID 2812 wrote to memory of 3916	2812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	90
PID 2812 wrote to memory of 3916	2812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	90
PID 2812 wrote to memory of 3916	2812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	90
PID 3916 wrote to memory of 1780	3916	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	91
PID 3916 wrote to memory of 1780	3916	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	91
PID 3916 wrote to memory of 1780	3916	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	91
PID 1780 wrote to memory of 4816	1780	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	92
PID 1780 wrote to memory of 4816	1780	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	92
PID 1780 wrote to memory of 4816	1780	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	92
PID 4816 wrote to memory of 5112	4816	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	93
PID 4816 wrote to memory of 5112	4816	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	93
PID 4816 wrote to memory of 5112	4816	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	93
PID 5112 wrote to memory of 1812	5112	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	94
PID 5112 wrote to memory of 1812	5112	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	94
PID 5112 wrote to memory of 1812	5112	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	94
PID 1812 wrote to memory of 520	1812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	95
PID 1812 wrote to memory of 520	1812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	95
PID 1812 wrote to memory of 520	1812	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	95
PID 520 wrote to memory of 1340	520	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	96
PID 520 wrote to memory of 1340	520	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	96
PID 520 wrote to memory of 1340	520	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	96
PID 1340 wrote to memory of 1964	1340	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	97
PID 1340 wrote to memory of 1964	1340	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	97
PID 1340 wrote to memory of 1964	1340	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	97
PID 1964 wrote to memory of 2560	1964	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	98
PID 1964 wrote to memory of 2560	1964	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	98
PID 1964 wrote to memory of 2560	1964	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	98
PID 2560 wrote to memory of 4036	2560	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	99
PID 2560 wrote to memory of 4036	2560	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	99
PID 2560 wrote to memory of 4036	2560	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	99
PID 4036 wrote to memory of 2988	4036	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	100
PID 4036 wrote to memory of 2988	4036	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	100
PID 4036 wrote to memory of 2988	4036	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	100
PID 2988 wrote to memory of 2976	2988	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	101
PID 2988 wrote to memory of 2976	2988	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	101
PID 2988 wrote to memory of 2976	2988	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	101
PID 2976 wrote to memory of 636	2976	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	102
PID 2976 wrote to memory of 636	2976	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	102
PID 2976 wrote to memory of 636	2976	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	102
PID 636 wrote to memory of 3860	636	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	103
PID 636 wrote to memory of 3860	636	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	103
PID 636 wrote to memory of 3860	636	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	103
PID 3860 wrote to memory of 1800	3860	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	104
PID 3860 wrote to memory of 1800	3860	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	104
PID 3860 wrote to memory of 1800	3860	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	104
PID 1800 wrote to memory of 5024	1800	be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe	105

C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
"C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
  "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
    "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
      "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        7⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        9⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        10⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        11⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        13⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:520
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        14⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        15⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        16⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        17⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        18⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        19⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        20⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:636
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        21⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        22⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        23⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        24⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        25⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        26⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        27⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        28⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:212
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        29⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        30⤵
        Drops file in Program Files directory
        Suspicious behavior: EnumeratesProcesses
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        31⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        32⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        33⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        34⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        35⤵
        Drops file in Program Files directory
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        36⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        37⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        38⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        39⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        40⤵
        System Location Discovery: System Language Discovery
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        43⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        44⤵
        Drops file in Program Files directory
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        45⤵
        Drops file in Program Files directory
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        46⤵
        Drops file in Program Files directory
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        47⤵
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        48⤵
        Drops file in Program Files directory
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        49⤵
        Drops file in Program Files directory
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        50⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        51⤵
        Drops file in Program Files directory
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        52⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        53⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        55⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        56⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        57⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        58⤵
        Drops file in Program Files directory
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        59⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        60⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        61⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        62⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        63⤵
        
        PID:1088
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        64⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        65⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        66⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        67⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        68⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        69⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        70⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        71⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        72⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        73⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        74⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        75⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        76⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        77⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        78⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2376
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        79⤵
        
        PID:180
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        80⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        81⤵
        Drops file in Program Files directory
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        82⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        83⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        84⤵
        Drops file in Program Files directory
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        85⤵
        
        PID:2428
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        86⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        87⤵
        System Location Discovery: System Language Discovery
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        88⤵
        Drops file in Program Files directory
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        89⤵
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        90⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        91⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        92⤵
        Drops file in Program Files directory
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        93⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        94⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        95⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        96⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        97⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        98⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        99⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        100⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        101⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        102⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        103⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        104⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        105⤵
        Drops file in Program Files directory
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        106⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        107⤵
        Drops file in Program Files directory
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        108⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        109⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        110⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        111⤵
        Drops file in Program Files directory
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        112⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        114⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        115⤵
        Drops file in Program Files directory
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        116⤵
        Drops file in Program Files directory
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        117⤵
        Drops file in Program Files directory
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        118⤵
        Drops file in Program Files directory
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        119⤵
        System Location Discovery: System Language Discovery
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        120⤵
        Drops file in Program Files directory
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        121⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        122⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        123⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        124⤵
        Drops file in Program Files directory
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        125⤵
        Drops file in Program Files directory
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        126⤵
        System Location Discovery: System Language Discovery
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        127⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        128⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        129⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        130⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        131⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        132⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        133⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        134⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        135⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        136⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        138⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        139⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        140⤵
        System Location Discovery: System Language Discovery
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        141⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        143⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        144⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        145⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        146⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        147⤵
        System Location Discovery: System Language Discovery
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        148⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        149⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        150⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        151⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        152⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        153⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        154⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        155⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        156⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        157⤵
        Drops file in Program Files directory
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        159⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        160⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        161⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        162⤵
        Drops file in Program Files directory
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        163⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        164⤵
        Drops file in Program Files directory
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        165⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        166⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        167⤵
        Drops file in Program Files directory
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        168⤵
        Drops file in Program Files directory
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        169⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        170⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        171⤵
        Drops file in Program Files directory
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        172⤵
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        173⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        174⤵
        Drops file in Program Files directory
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        175⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        176⤵
        Drops file in Program Files directory
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        177⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        178⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        179⤵
        Drops file in Program Files directory
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        180⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        181⤵
        Drops file in Program Files directory
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        182⤵
        System Location Discovery: System Language Discovery
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        183⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        184⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        185⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        186⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        187⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        188⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        189⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        190⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        191⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        192⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        193⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        194⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        195⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        196⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        197⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        198⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        199⤵
        System Location Discovery: System Language Discovery
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        200⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        201⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        202⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        203⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        204⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        205⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        206⤵
        System Location Discovery: System Language Discovery
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        207⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        208⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        209⤵
        System Location Discovery: System Language Discovery
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        210⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        211⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        212⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        213⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        214⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        215⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        216⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        217⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        218⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        219⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        220⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        221⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        222⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        223⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        224⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        225⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        226⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        227⤵
        System Location Discovery: System Language Discovery
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        228⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        229⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        230⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        231⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        232⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        233⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        234⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        235⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        236⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        237⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        238⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        239⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        240⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        241⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        242⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        243⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        244⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        245⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        246⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        247⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        248⤵
        System Location Discovery: System Language Discovery
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        249⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        250⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        251⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        252⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        253⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        254⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        255⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        256⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        257⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        258⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        259⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        260⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        261⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        262⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        263⤵
        System Location Discovery: System Language Discovery
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        264⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        265⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        266⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        267⤵
        System Location Discovery: System Language Discovery
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        268⤵
        System Location Discovery: System Language Discovery
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        269⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        270⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        271⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        272⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        273⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        274⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        275⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        276⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        277⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        278⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        279⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        280⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        281⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        282⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        283⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        284⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        285⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        286⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        287⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        288⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        289⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        290⤵
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        291⤵
        Drops file in Program Files directory
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        292⤵
        Drops file in Program Files directory
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        293⤵
        Drops file in Program Files directory
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        294⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        295⤵
        System Location Discovery: System Language Discovery
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        296⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        297⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        298⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        299⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        300⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        301⤵
        System Location Discovery: System Language Discovery
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        302⤵
        System Location Discovery: System Language Discovery
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        303⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        304⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        305⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        306⤵
        System Location Discovery: System Language Discovery
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        307⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        308⤵
        System Location Discovery: System Language Discovery
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        309⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        310⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        311⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        312⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        313⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        314⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        315⤵
        System Location Discovery: System Language Discovery
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        316⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        317⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        318⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        319⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        320⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        321⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        322⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        323⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        324⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        325⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        326⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        327⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        328⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        329⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        330⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        331⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        332⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        333⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        334⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        335⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        336⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        337⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        338⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        339⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        340⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        341⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        342⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        343⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        344⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        345⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        346⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        347⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        348⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        349⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        350⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        351⤵
        
        PID:10408
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        352⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        353⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        354⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        355⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        356⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        357⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        358⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        359⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        360⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        361⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        362⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        363⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        364⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        365⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        366⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        367⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        368⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        369⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        370⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        371⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        372⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        373⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        374⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        375⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        376⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        377⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        378⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        379⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        380⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        381⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        382⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        383⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        384⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        385⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        386⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        387⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        388⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        389⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        390⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        391⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        392⤵
        
        PID:232
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        393⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        394⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        395⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        396⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        397⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        398⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        399⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        400⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        401⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        402⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        403⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        404⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        405⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        406⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        407⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        408⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        409⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        410⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        411⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        412⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        413⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        414⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        415⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        416⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        417⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        418⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        419⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        420⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        421⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        422⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        423⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        424⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        425⤵
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        426⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        427⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        428⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        429⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        430⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        431⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        432⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        433⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        434⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        435⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        436⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        437⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        438⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        439⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        440⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        441⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        442⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        443⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        444⤵
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        445⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        446⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        447⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        448⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        449⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        450⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        451⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        452⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        453⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        454⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        455⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        456⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        457⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        458⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        459⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        460⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        461⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        462⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        463⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        464⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        465⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        466⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        467⤵
        
        PID:10756
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        468⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        469⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        470⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        471⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        472⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        473⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        474⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        475⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        476⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        477⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        478⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        479⤵
        
        PID:10872
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        480⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        481⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        482⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        483⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        484⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        485⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        486⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        487⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        488⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        489⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        490⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        491⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        492⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        493⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        494⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        495⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        496⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        497⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        498⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        499⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        500⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        501⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        502⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        503⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        504⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        505⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        506⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        507⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        508⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        509⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        510⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        511⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        512⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        513⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        514⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        515⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        516⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        517⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        518⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        519⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        520⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        521⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        522⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        523⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        524⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        525⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        526⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        527⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        528⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe
        
        "C:\Users\Admin\AppData\Local\Temp\be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2N.exe"
        529⤵
        
        PID:7912
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7640 -s 432
        437⤵
        Program crash
        
        PID:5868
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6152 -s 448
        406⤵
        Program crash
        
        PID:2120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10304 -s 448
        340⤵
        Program crash
        
        PID:7408
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 11212 -s 388
        336⤵
        Program crash
        
        PID:9424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10696 -s 388
        320⤵
        Program crash
        
        PID:9964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9376 -s 428
        317⤵
        Program crash
        
        PID:11196
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10596 -s 392
        314⤵
        Program crash
        
        PID:6540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9048 -s 440
        299⤵
        Program crash
        
        PID:2436
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9012 -s 384
        298⤵
        Program crash
        
        PID:3444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8764 -s 392
        293⤵
        Program crash
        
        PID:10084
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8596 -s 428
        286⤵
        Program crash
        
        PID:6480
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8560 -s 388
        284⤵
        Program crash
        
        PID:10744
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8148 -s 452
        239⤵
        Program crash
        
        PID:3108
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7228 -s 392
        183⤵
        Program crash
        
        PID:8964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7148 -s 448
        182⤵
        Program crash
        
        PID:8352
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7372 -s 404
        181⤵
        Program crash
        
        PID:9528
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6460 -s 428
        170⤵
        Program crash
        
        PID:9896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 384
        169⤵
        Program crash
        
        PID:2572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 396
        161⤵
        Program crash
        
        PID:7876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 396
        161⤵
        Program crash
        
        PID:9308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6200 -s 436
        160⤵
        Program crash
        
        PID:9796
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5624 -s 388
        126⤵
        Program crash
        
        PID:9532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5608 -s 384
        125⤵
        Program crash
        
        PID:10236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 440
        124⤵
        Program crash
        
        PID:10964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 440
        124⤵
        Program crash
        
        PID:10972
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 460
        123⤵
        Program crash
        
        PID:6444
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5556 -s 428
        123⤵
        Program crash
        
        PID:6664
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5540 -s 400
        122⤵
        Program crash
        
        PID:10740
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 448
        121⤵
        Program crash
        
        PID:8968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 432
        120⤵
        Program crash
        
        PID:7020
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5504 -s 432
        120⤵
        Program crash
        
        PID:6604
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5480 -s 448
        119⤵
        Program crash
        
        PID:9628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5432 -s 452
        116⤵
        Program crash
        
        PID:11112
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 388
        115⤵
        Program crash
        
        PID:11052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5416 -s 456
        115⤵
        Program crash
        
        PID:10048
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5204 -s 440
        104⤵
        Program crash
        
        PID:4956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5176 -s 444
        103⤵
        Program crash
        
        PID:4500
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1208 -s 388
        91⤵
        Program crash
        
        PID:1456
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4396 -s 444
        88⤵
        Program crash
        
        PID:9532
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 436
        85⤵
        Program crash
        
        PID:6232
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1912 -s 452
        85⤵
        Program crash
        
        PID:3844
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 448
        81⤵
        Program crash
        
        PID:7288
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 448
        75⤵
        Program crash
        
        PID:9596
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 440
        73⤵
        Program crash
        
        PID:4856
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 440
        73⤵
        Program crash
        
        PID:7968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3364 -s 428
        70⤵
        Program crash
        
        PID:3628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 456
        64⤵
        Program crash
        
        PID:7736
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 904 -s 448
        58⤵
        Program crash
        
        PID:8308
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 444
        45⤵
        Program crash
        
        PID:10732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4844 -s 464
        44⤵
        Program crash
        
        PID:6240
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4356 -s 440
        43⤵
        Program crash
        
        PID:5380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 232 -s 440
        42⤵
        Program crash
        
        PID:10628
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4976 -s 384
        35⤵
        Program crash
        
        PID:8732
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2380 -s 440
        31⤵
        Program crash
        
        PID:10792
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5060 -s 444
        26⤵
        Program crash
        
        PID:10176
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1372 -s 452
        25⤵
        Program crash
        
        PID:11252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 464
        23⤵
        Program crash
        
        PID:9088
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4816 -s 368
        11⤵
        Program crash
        
        PID:6224
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3916 -s 456
        9⤵
        Program crash
        
        PID:2392
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 456
        8⤵
        Program crash
        
        PID:2932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 436
      4⤵
      Program crash
      PID:4480
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 476
  2⤵
  - Program crash
  PID:9880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5556 -ip 5556
1⤵
PID:6920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5504 -ip 5504
1⤵
PID:6932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5504 -ip 5504
1⤵
PID:6764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5556 -ip 5556
1⤵
PID:6576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 5524 -ip 5524
1⤵
PID:8968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 5540 -ip 5540
1⤵
PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5576 -ip 5576
1⤵
PID:9020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 5608 -ip 5608
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 4616 -ip 4616
1⤵
PID:9028

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 1864 -ip 1864
1⤵
PID:9040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4616 -ip 4616
1⤵
PID:9464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 5480 -ip 5480
1⤵
PID:10960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1864 -ip 1864
1⤵
PID:9684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 8528 -ip 8528
1⤵
PID:10812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 8632 -ip 8632
1⤵
PID:11212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 8580 -ip 8580
1⤵
PID:9676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 8560 -ip 8560
1⤵
PID:9304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 8632 -ip 8632
1⤵
PID:10704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 8580 -ip 8580
1⤵
PID:10592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 8764 -ip 8764
1⤵
PID:10600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 8816 -ip 8816
1⤵
PID:10612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 8528 -ip 8528
1⤵
PID:10628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 684 -p 5480 -ip 5480
1⤵
PID:10640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 8560 -ip 8560
1⤵
PID:10004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5576 -ip 5576
1⤵
PID:11240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 5608 -ip 5608
1⤵
PID:11248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5540 -ip 5540
1⤵
PID:8576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 5524 -ip 5524
1⤵
PID:11132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4036 -ip 4036
1⤵
PID:8712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2976 -ip 2976
1⤵
PID:9312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 8816 -ip 8816
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 2636 -ip 2636
1⤵
PID:10452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 2596 -ip 2596
1⤵
PID:11128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 4088 -ip 4088
1⤵
PID:10692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 4080 -ip 4080
1⤵
PID:10780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 796 -p 2040 -ip 2040
1⤵
PID:10804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4396 -ip 4396
1⤵
PID:11176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 4036 -ip 4036
1⤵
PID:9004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 10228 -ip 10228
1⤵
PID:10508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 9700 -ip 9700
1⤵
PID:9504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2976 -ip 2976
1⤵
PID:10436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 876 -p 4088 -ip 4088
1⤵
PID:10296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 5252 -ip 5252
1⤵
PID:9348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 4080 -ip 4080
1⤵
PID:11112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 896 -p 2040 -ip 2040
1⤵
PID:9636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 4508 -ip 4508
1⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5124 -ip 5124
1⤵
PID:4536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2636 -ip 2636
1⤵
PID:10352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 744 -p 5416 -ip 5416
1⤵
PID:11240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 872 -p 4396 -ip 4396
1⤵
PID:9160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 9700 -ip 9700
1⤵
PID:9124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 696 -p 5432 -ip 5432
1⤵
PID:9864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 2280 -ip 2280
1⤵
PID:9104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 10228 -ip 10228
1⤵
PID:9212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 8680 -ip 8680
1⤵
PID:8844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 2596 -ip 2596
1⤵
PID:10952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 920 -p 5252 -ip 5252
1⤵
PID:9564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 2064 -ip 2064
1⤵
PID:10096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 2116 -ip 2116
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 4508 -ip 4508
1⤵
PID:9788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 652 -p 5124 -ip 5124
1⤵
PID:10628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 644 -ip 644
1⤵
PID:8740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 5432 -ip 5432
1⤵
PID:5784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 1284 -ip 1284
1⤵
PID:10264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 8680 -ip 8680
1⤵
PID:9156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2280 -ip 2280
1⤵
PID:11216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2116 -ip 2116
1⤵
PID:9208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 700 -p 2064 -ip 2064
1⤵
PID:8804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1372 -ip 1372
1⤵
PID:9336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 636 -ip 636
1⤵
PID:11140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 768 -p 2380 -ip 2380
1⤵
PID:10220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 5024 -ip 5024
1⤵
PID:11100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 8764 -ip 8764
1⤵
PID:10316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1284 -ip 1284
1⤵
PID:9680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 212 -ip 212
1⤵
PID:11144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 2944 -ip 2944
1⤵
PID:9548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 232 -ip 232
1⤵
PID:9748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 412 -ip 412
1⤵
PID:10088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 1372 -ip 1372
1⤵
PID:9696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 2380 -ip 2380
1⤵
PID:9500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 636 -ip 636
1⤵
PID:9304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 948 -p 5024 -ip 5024
1⤵
PID:5264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 212 -ip 212
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2944 -ip 2944
1⤵
PID:9624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 412 -ip 412
1⤵
PID:10756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5416 -ip 5416
1⤵
PID:10156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 232 -ip 232
1⤵
PID:11012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 644 -ip 644
1⤵
PID:5580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 904 -ip 904
1⤵
PID:9152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 3100 -ip 3100
1⤵
PID:11024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6200 -ip 6200
1⤵
PID:7592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 5624 -ip 5624
1⤵
PID:8824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6460 -ip 6460
1⤵
PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 904 -ip 904
1⤵
PID:5560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 6452 -ip 6452
1⤵
PID:11156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 6452 -ip 6452
1⤵
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 912 -p 4612 -ip 4612
1⤵
PID:8872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3100 -ip 3100
1⤵
PID:8812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 4612 -ip 4612
1⤵
PID:7300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 1800 -ip 1800
1⤵
PID:7356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5060 -ip 5060
1⤵
PID:8012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 6200 -ip 6200
1⤵
PID:7292

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 1800 -ip 1800
1⤵
PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6460 -ip 6460
1⤵
PID:1624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 5624 -ip 5624
1⤵
PID:5788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 10620 -ip 10620
1⤵
PID:10956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 4816 -ip 4816
1⤵
PID:11144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1376 -ip 1376
1⤵
PID:10796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 10620 -ip 10620
1⤵
PID:9964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 1964 -ip 1964
1⤵
PID:10376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1936 -ip 1936
1⤵
PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 3916 -ip 3916
1⤵
PID:7472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1004 -p 10568 -ip 10568
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 1780 -ip 1780
1⤵
PID:10988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 1340 -ip 1340
1⤵
PID:7276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5112 -ip 5112
1⤵
PID:9312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4548 -ip 4548
1⤵
PID:10084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 1964 -ip 1964
1⤵
PID:7668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1936 -ip 1936
1⤵
PID:9796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1780 -ip 1780
1⤵
PID:5496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 10568 -ip 10568
1⤵
PID:8940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5112 -ip 5112
1⤵
PID:10648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 692 -p 4548 -ip 4548
1⤵
PID:2964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 3916 -ip 3916
1⤵
PID:6376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 1340 -ip 1340
1⤵
PID:10576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 3364 -ip 3364
1⤵
PID:9996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 180 -ip 180
1⤵
PID:10768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 2572 -ip 2572
1⤵
PID:9964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1020 -p 4384 -ip 4384
1⤵
PID:212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 4888 -ip 4888
1⤵
PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1088 -ip 1088
1⤵
PID:10936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 4588 -ip 4588
1⤵
PID:8856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 4628 -ip 4628
1⤵
PID:10980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 2204 -ip 2204
1⤵
PID:4688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 5060 -ip 5060
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 724 -p 4280 -ip 4280
1⤵
PID:10524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 8664 -ip 8664
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3364 -ip 3364
1⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 2572 -ip 2572
1⤵
PID:9560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 180 -ip 180
1⤵
PID:9496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 644 -p 4384 -ip 4384
1⤵
PID:10136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 1208 -ip 1208
1⤵
PID:9288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4888 -ip 4888
1⤵
PID:8828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 6548 -ip 6548
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7212 -ip 7212
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4816 -ip 4816
1⤵
PID:7576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1376 -ip 1376
1⤵
PID:7468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 4628 -ip 4628
1⤵
PID:3284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 4588 -ip 4588
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 676 -p 1208 -ip 1208
1⤵
PID:10312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 10696 -ip 10696
1⤵
PID:1124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 8664 -ip 8664
1⤵
PID:9896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 2204 -ip 2204
1⤵
PID:9532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 980 -p 7212 -ip 7212
1⤵
PID:8872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 6548 -ip 6548
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4280 -ip 4280
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8612 -ip 8612
1⤵
PID:11052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 8696 -ip 8696
1⤵
PID:10880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 8544 -ip 8544
1⤵
PID:11000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 8648 -ip 8648
1⤵
PID:5736

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 804 -p 10132 -ip 10132
1⤵
PID:2068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 9544 -ip 9544
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 9224 -ip 9224
1⤵
PID:9520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 10072 -ip 10072
1⤵
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 11148 -ip 11148
1⤵
PID:9244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 900 -p 7640 -ip 7640
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 9772 -ip 9772
1⤵
PID:10944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 11080 -ip 11080
1⤵
PID:5896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 8696 -ip 8696
1⤵
PID:4816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 5268 -ip 5268
1⤵
PID:7448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 8612 -ip 8612
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 9544 -ip 9544
1⤵
PID:4328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 2104 -ip 2104
1⤵
PID:11052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 8544 -ip 8544
1⤵
PID:10024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 8648 -ip 8648
1⤵
PID:9784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 10132 -ip 10132
1⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 1288 -ip 1288
1⤵
PID:4524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 5332 -ip 5332
1⤵
PID:11096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 2792 -ip 2792
1⤵
PID:11196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 5220 -ip 5220
1⤵
PID:7408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 9012 -ip 9012
1⤵
PID:2136

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 7640 -ip 7640
1⤵
PID:11120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 11148 -ip 11148
1⤵
PID:5680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 660 -p 9224 -ip 9224
1⤵
PID:2908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 960 -p 2776 -ip 2776
1⤵
PID:6104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 10072 -ip 10072
1⤵
PID:7728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 5176 -ip 5176
1⤵
PID:6160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 9772 -ip 9772
1⤵
PID:5228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3568 -ip 3568
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9200 -ip 9200
1⤵
PID:9284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 800 -p 9048 -ip 9048
1⤵
PID:11012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 4288 -ip 4288
1⤵
PID:64

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4736 -ip 4736
1⤵
PID:7584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 11080 -ip 11080
1⤵
PID:5836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 5016 -ip 5016
1⤵
PID:2692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 5268 -ip 5268
1⤵
PID:1404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 2104 -ip 2104
1⤵
PID:7152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 1704 -ip 1704
1⤵
PID:10348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 2792 -ip 2792
1⤵
PID:5360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 1288 -ip 1288
1⤵
PID:9456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 5220 -ip 5220
1⤵
PID:7460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 1088 -ip 1088
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 5332 -ip 5332
1⤵
PID:9144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 2776 -ip 2776
1⤵
PID:10536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 716 -p 3568 -ip 3568
1⤵
PID:5056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 9048 -ip 9048
1⤵
PID:5628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 972 -p 5176 -ip 5176
1⤵
PID:7628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 9200 -ip 9200
1⤵
PID:11208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4736 -ip 4736
1⤵
PID:2172

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 5016 -ip 5016
1⤵
PID:9112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 2696 -ip 2696
1⤵
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 1704 -ip 1704
1⤵
PID:9628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 3188 -ip 3188
1⤵
PID:5888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 844 -p 2072 -ip 2072
1⤵
PID:5364

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 10696 -ip 10696
1⤵
PID:8692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 9252 -ip 9252
1⤵
PID:11084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 6504 -ip 6504
1⤵
PID:11124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6572 -ip 6572
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 2696 -ip 2696
1⤵
PID:9932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 3188 -ip 3188
1⤵
PID:9892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 6468 -ip 6468
1⤵
PID:4624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 732 -p 10596 -ip 10596
1⤵
PID:8068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 2196 -ip 2196
1⤵
PID:8084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 2428 -ip 2428
1⤵
PID:6276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 368 -ip 368
1⤵
PID:6828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 928 -p 2376 -ip 2376
1⤵
PID:7056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 884 -p 10192 -ip 10192
1⤵
PID:10536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 9012 -ip 9012
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3860 -ip 3860
1⤵
PID:10520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 784 -p 2588 -ip 2588
1⤵
PID:7536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 9252 -ip 9252
1⤵
PID:8652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 932 -p 6504 -ip 6504
1⤵
PID:5340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 6572 -ip 6572
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 6468 -ip 6468
1⤵
PID:10576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2072 -ip 2072
1⤵
PID:5148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4288 -ip 4288
1⤵
PID:10760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 368 -ip 368
1⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 4976 -ip 4976
1⤵
PID:5328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1040 -p 6236 -ip 6236
1⤵
PID:10280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3860 -ip 3860
1⤵
PID:8280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 856 -p 10192 -ip 10192
1⤵
PID:10896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 7372 -ip 7372
1⤵
PID:9156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2376 -ip 2376
1⤵
PID:5512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 2428 -ip 2428
1⤵
PID:10384

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 2588 -ip 2588
1⤵
PID:9184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 7148 -ip 7148
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1036 -p 1416 -ip 1416
1⤵
PID:9404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 7228 -ip 7228
1⤵
PID:8816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 6236 -ip 6236
1⤵
PID:4372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 7372 -ip 7372
1⤵
PID:6216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 7228 -ip 7228
1⤵
PID:2572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1416 -ip 1416
1⤵
PID:4848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 10596 -ip 10596
1⤵
PID:8372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 2196 -ip 2196
1⤵
PID:6048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 3016 -ip 3016
1⤵
PID:10152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5348 -ip 5348
1⤵
PID:2208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 864 -p 4976 -ip 4976
1⤵
PID:5616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 5548 -ip 5548
1⤵
PID:8936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 11212 -ip 11212
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 3016 -ip 3016
1⤵
PID:10308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 5348 -ip 5348
1⤵
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5548 -ip 5548
1⤵
PID:8264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 10892 -ip 10892
1⤵
PID:9048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 7640 -ip 7640
1⤵
PID:7480

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 11212 -ip 11212
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 10304 -ip 10304
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 10188 -ip 10188
1⤵
PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 9888 -ip 9888
1⤵
PID:1740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 10300 -ip 10300
1⤵
PID:6880

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2396 -ip 2396
1⤵
PID:9892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 10880 -ip 10880
1⤵
PID:904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5612 -ip 5612
1⤵
PID:7864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 232 -ip 232
1⤵
PID:4452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4756 -ip 4756
1⤵
PID:8492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5464 -ip 5464
1⤵
PID:7400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 5124 -ip 5124
1⤵
PID:2188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 10892 -ip 10892
1⤵
PID:6884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 7148 -ip 7148
1⤵
PID:4296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 10188 -ip 10188
1⤵
PID:9452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 756 -p 10300 -ip 10300
1⤵
PID:7352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4936 -ip 4936
1⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 2396 -ip 2396
1⤵
PID:8688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 10304 -ip 10304
1⤵
PID:6440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 9888 -ip 9888
1⤵
PID:9036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 812 -p 232 -ip 232
1⤵
PID:10464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 10880 -ip 10880
1⤵
PID:5940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 8596 -ip 8596
1⤵
PID:6464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 5612 -ip 5612
1⤵
PID:5884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1000 -p 4756 -ip 4756
1⤵
PID:10520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 1912 -ip 1912
1⤵
PID:2220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 5464 -ip 5464
1⤵
PID:8800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 5124 -ip 5124
1⤵
PID:9120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 996 -p 4936 -ip 4936
1⤵
PID:8580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 880 -p 3180 -ip 3180
1⤵
PID:2984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 7748 -ip 7748
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 4860 -ip 4860
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 5140 -ip 5140
1⤵
PID:6056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 944 -p 4416 -ip 4416
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1032 -p 8596 -ip 8596
1⤵
PID:7656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 4644 -ip 4644
1⤵
PID:10580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 828 -p 1328 -ip 1328
1⤵
PID:6452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 436 -ip 436
1⤵
PID:10888

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 4412 -ip 4412
1⤵
PID:2584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 952 -p 2812 -ip 2812
1⤵
PID:8520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 7748 -ip 7748
1⤵
PID:8524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 6992 -ip 6992
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 4860 -ip 4860
1⤵
PID:1216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 740 -p 3180 -ip 3180
1⤵
PID:6568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 816 -p 5140 -ip 5140
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 5160 -ip 5160
1⤵
PID:8652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 4416 -ip 4416
1⤵
PID:7716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1092 -p 3576 -ip 3576
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7640 -ip 7640
1⤵
PID:9052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 5204 -ip 5204
1⤵
PID:6504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1328 -ip 1328
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 4644 -ip 4644
1⤵
PID:9868

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 824 -p 11140 -ip 11140
1⤵
PID:9812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 992 -p 436 -ip 436
1⤵
PID:8808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 704 -p 6220 -ip 6220
1⤵
PID:1464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 9516 -ip 9516
1⤵
PID:944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 10556 -ip 10556
1⤵
PID:3340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 10676 -ip 10676
1⤵
PID:1964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1048 -p 6992 -ip 6992
1⤵
PID:7132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 968 -p 5448 -ip 5448
1⤵
PID:8280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4376 -ip 4376
1⤵
PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 892 -p 6152 -ip 6152
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1064 -p 4412 -ip 4412
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 5088 -ip 5088
1⤵
PID:9916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 908 -p 5160 -ip 5160
1⤵
PID:10648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 3576 -ip 3576
1⤵
PID:1704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1096 -p 5204 -ip 5204
1⤵
PID:8848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 11140 -ip 11140
1⤵
PID:10180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 868 -p 6220 -ip 6220
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1104 -p 9516 -ip 9516
1⤵
PID:10572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 10676 -ip 10676
1⤵
PID:5444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 924 -p 10556 -ip 10556
1⤵
PID:10248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1112 -p 5448 -ip 5448
1⤵
PID:9580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 780 -p 4376 -ip 4376
1⤵
PID:5544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 5088 -ip 5088
1⤵
PID:8432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 9376 -ip 9376
1⤵
PID:8968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1156 -p 1912 -ip 1912
1⤵
PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1068 -p 3948 -ip 3948
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 688 -p 4380 -ip 4380
1⤵
PID:3444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 5412 -ip 5412
1⤵
PID:9424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 9332 -ip 9332
1⤵
PID:5556

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 988 -p 6324 -ip 6324
1⤵
PID:6328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 8824 -ip 8824
1⤵
PID:3628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1100 -p 2560 -ip 2560
1⤵
PID:10072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1160 -p 2812 -ip 2812
1⤵
PID:7832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 848 -p 3108 -ip 3108
1⤵
PID:3268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6372 -ip 6372
1⤵
PID:5928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 836 -p 3948 -ip 3948
1⤵
PID:9836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1016 -p 9332 -ip 9332
1⤵
PID:7060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 620 -p 5412 -ip 5412
1⤵
PID:10324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 4380 -ip 4380
1⤵
PID:5624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1080 -p 8824 -ip 8824
1⤵
PID:6892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 6324 -ip 6324
1⤵
PID:8764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1052 -p 2560 -ip 2560
1⤵
PID:3352

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 888 -p 7904 -ip 7904
1⤵
PID:6240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1012 -p 6372 -ip 6372
1⤵
PID:8264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 840 -p 7852 -ip 7852
1⤵
PID:3516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1120 -p 3108 -ip 3108
1⤵
PID:10184

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1124 -p 7772 -ip 7772
1⤵
PID:10224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 2960 -ip 2960
1⤵
PID:7928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4864 -ip 4864
1⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4356 -ip 4356
1⤵
PID:9444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 4844 -ip 4844
1⤵
PID:6336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 904 -p 6456 -ip 6456
1⤵
PID:3972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 6180 -ip 6180
1⤵
PID:8656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 860 -p 6964 -ip 6964
1⤵
PID:9388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1072 -p 6284 -ip 6284
1⤵
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 940 -p 856 -ip 856
1⤵
PID:8648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 6152 -ip 6152
1⤵
PID:6552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 668 -p 3512 -ip 3512
1⤵
PID:9072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 5100 -ip 5100
1⤵
PID:5956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6492 -ip 6492
1⤵
PID:9496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7904 -ip 7904
1⤵
PID:4912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 788 -p 7632 -ip 7632
1⤵
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 764 -p 8112 -ip 8112
1⤵
PID:5424

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 752 -p 8132 -ip 8132
1⤵
PID:3916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6256 -ip 6256
1⤵
PID:8420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 820 -p 6388 -ip 6388
1⤵
PID:4244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 748 -p 6132 -ip 6132
1⤵
PID:8524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 760 -p 7852 -ip 7852
1⤵
PID:8564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 712 -p 6252 -ip 6252
1⤵
PID:7320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 776 -p 6620 -ip 6620
1⤵
PID:5144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 792 -p 7772 -ip 7772
1⤵
PID:5156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 720 -p 2960 -ip 2960
1⤵
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 916 -p 744 -ip 744
1⤵
PID:10896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1076 -p 4864 -ip 4864
1⤵
PID:8220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 976 -p 6524 -ip 6524
1⤵
PID:9568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 6296 -ip 6296
1⤵
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 636 -p 6128 -ip 6128
1⤵
PID:3792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1084 -p 8160 -ip 8160
1⤵
PID:5720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6120 -ip 6120
1⤵
PID:8756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 8148 -ip 8148
1⤵
PID:5176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 672 -p 8088 -ip 8088
1⤵
PID:6092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1060 -p 520 -ip 520
1⤵
PID:6996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 728 -p 7052 -ip 7052
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 852 -p 7108 -ip 7108
1⤵
PID:5212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6964 -ip 6964
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1116 -p 6180 -ip 6180
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8112 -ip 8112
1⤵
PID:6624

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 4844 -ip 4844
1⤵
PID:3096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1196 -p 6492 -ip 6492
1⤵
PID:9156

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1224 -p 6284 -ip 6284
1⤵
PID:5540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1252 -p 7632 -ip 7632
1⤵
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1276 -p 6456 -ip 6456
1⤵
PID:5924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1304 -p 856 -ip 856
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1328 -p 7936 -ip 7936
1⤵
PID:8252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1344 -p 6256 -ip 6256
1⤵
PID:8124

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1372 -p 6388 -ip 6388
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1416 -p 5100 -ip 5100
1⤵
PID:5348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1444 -p 3512 -ip 3512
1⤵
PID:3016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1472 -p 8132 -ip 8132
1⤵
PID:9964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1500 -p 6132 -ip 6132
1⤵
PID:6756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1512 -p 10104 -ip 10104
1⤵
PID:8416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 612 -p 9208 -ip 9208
1⤵
PID:7820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1516 -p 9376 -ip 9376
1⤵
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 8160 -ip 8160
1⤵
PID:9152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1044 -p 6620 -ip 6620
1⤵
PID:7484

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1520 -p 6128 -ip 6128
1⤵
PID:10212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1432 -p 6296 -ip 6296
1⤵
PID:2792

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1292 -p 2776 -ip 2776
1⤵
PID:5504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1316 -p 7052 -ip 7052
1⤵
PID:9952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 772 -p 7108 -ip 7108
1⤵
PID:9536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 6120 -ip 6120
1⤵
PID:8928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 736 -p 8088 -ip 8088
1⤵
PID:4360

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 628 -p 6524 -ip 6524
1⤵
PID:10468

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1432 -p 7984 -ip 7984
1⤵
PID:9752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 956 -p 6252 -ip 6252
1⤵
PID:7776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 1336 -p 744 -ip 744
1⤵
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 664 -p 10104 -ip 10104
1⤵
PID:10916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RCX33BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX33BF.tmp
Size 596KB
SHA256 0829734af635fc0467802f1cc681948f62a3fe3fbe620aa4d242d1c6094efb87
MD5 f832f817c4595acaad25ef7d2321ba71
SHA1 79bf1f7971997298e6b8a74a6a92cae5059cdf27
SHA512 ff0aa364e8856b3e59eff1b1e3cd7f1945d80e8dee1d7bcfa44f2b7a264ebd47e3b8980fc9be7832d0bee7f189d8c19678c52602d574781414d88cc706b36052
SSDEEP 6144:G1egp/3ULOJQSfbzDRU5DJqj2uUZARb0:543ULO2oiSG
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX33C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX33C0.tmp
Size 612KB
SHA256 ed0495a2b8b01438a68550d5f05d763f3c538c7782597e9cc77c4b60d1bb2a51
MD5 e15619c8090e96553829f71d6830006b
SHA1 a38f1903e12ec0344b478e3e626347f4df0b68b6
SHA512 479275898be9b5192387e2826ed311e9f4baa5929f1a308b5e2c5a39edcb141c398d70f4d83dbb780cd114e761d09ac99e535782f56c1977d23c77136bf025fa
SSDEEP 6144:f1egp/3ULOJQSfbzDRU5DJqj2uUZARb0suf:U43ULO2oiSa
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX8F9F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8F9F.tmp
Size 4.7MB
SHA256 523b5481c331756284905dcfdcbc7a00f2755763c9d0551d2a097fa2f73ec1d4
MD5 7ead1a45b2a0b8c9b17c480d5f8249ab
SHA1 8043cc0df5e6ae41a1838ba3426b4db3f20b3a9c
SHA512 6f8566a9c502f64ec981ec6bfa725f2a00710f4974cbccab237b7d8f807b31f550637c3c75a087044f10aa6bd099f3c2899047b29a77fc39dec54686cb1d4bf6
SSDEEP 98304:dt5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:dAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX8FE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX8FE0.tmp
Size 4.7MB
SHA256 90c24507bda9e8b1ab2e441bc9b7a689d7e77bd5fc911e60b3421ce6cc05e1b2
MD5 622cb5ea32fa988bae6ff56f99414ac6
SHA1 59cb421b2ab96c2245767b7c7eadc6b64597658c
SHA512 cb19815c6756771f4521a6cbd5ee572d087b60b3b67565d02f5fb6e637bd363aad1983c9abc516c733876cb53996c16f071fc21c08f5a057863008037fc0c38c
SSDEEP 98304:pt5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:pAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX9040.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9040.tmp
Size 4.7MB
SHA256 6d9ce16f274f112c76035f0cc17dbbc34da792cb85721b71929f8a53c810b8fe
MD5 28a8c0a77ce3587143b7ad38524c17b4
SHA1 37a8ebcab77863c20d99d2a0bae265b01f30b492
SHA512 58f5042f2a5ff4e3ae3edb3e0dde7bde822a55a298dcffa87ef419a84953a494ccd9a77dc51c99e28f2c51906036904115c252389f95a5dd977b36c6b5294248
SSDEEP 98304:Ct5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:CAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX9895.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX9895.tmp
Size 603KB
SHA256 0d567a3c8b194716638c447842106b2698ca7283f3feae733d0e836719c8e994
MD5 c63268d3d6405f9b782f7178f5efead5
SHA1 ba03d25700c67a9df9835dcd1848258dcc1498ae
SHA512 430df5e6b3c41da98ae30a074124b3a960120fdb3e0621529b157e4e0240cf2b12a90ce56aa407e9e634f56332d39a3b95f19d93e3a119acd91f09557f3ae755
SSDEEP 6144:d1egp/3ULOJQSfbzDRU5DJqj2uUZARbmwc:i43ULO2oiS/c
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCX98A5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX98A5.tmp
Size 1.5MB
SHA256 6a5ce4eee6d58185cc31b3e18b11309e318908755b05232b81c6b9724a7cd90e
MD5 0c7dad0ee971cb6cedaeb89c562c9f28
SHA1 fc8d7217e1a297e3d902ee45fa09cb8aab066ac5
SHA512 1e47bbb8a2a580763b788f8c603a06c11f047744920f87e77b308b9c45b596d1fdcaacb7259ff7dbd2e5c69a38bf4b57b936a03fb0437a4a181990d56a38b9ef
SSDEEP 24576:6sO2G4UhSo7ydGRGHB0d+h44tFDfJzCacNC:w2uhJUGRMM+NtD1cN
MD5 SHA1 SHA512 SSDEEP

Submit Download

RCXF303.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXF303.tmp
Size 4.7MB
SHA256 b3ca23db29fa3dc5b431abd90c4a74bacb985d0665af77ea8f2fb147ba93a5b4
MD5 918cb15ec384e1656a16353a3774f34f
SHA1 d1c9c5f76db2b2cc3f3cced5a05e78861f9d460e
SHA512 ae4884df819408d834cfef7da639f253cc578899b32cf5b79dc2700de58ae0bf0b1ea1289a47d8e748b65fb82d9378ecb5da0c98d0fc3f318281f55effcc1495
SSDEEP 98304:St5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:SAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

pUc8F50.tmp

Path C:\Users\Admin\AppData\Local\Temp\pUc8F50.tmp
Size 4.8MB
SHA256 be64c81fdb1decfcddccb48c743565e0abd260c3d9184bc915fe9e8f351936c2
MD5 4d09a67b1d1aef7dc9f944a617c32eb0
SHA1 1c98026c29ed9a6cb58bbdc7a75bee0d50bda541
SHA512 cf05660b77618531eccb4f122b74d11750a78f75602b3325c555b47fd7f145d971b30964f5b102cbcb9e2466f54fd9592eef2d9300e2ee872edafb162c7e185e
SSDEEP 98304:Ot5ezDp4NSLqXogtLESS4jB3ts3Fw7r4pbPhvsPZYfXdUO:OAMSXgt9S4V3S3FI4pdUPZoXdR
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-774-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/412-773-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/520-759-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/636-3649-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/636-766-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/744-748-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1340-760-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1372-770-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1376-747-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1780-755-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1800-768-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1812-758-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1864-2343-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1936-749-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/1964-761-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2380-776-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2560-762-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2560-3599-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2696-752-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2812-753-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2976-3648-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2976-765-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2988-764-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/2988-3601-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3108-777-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3576-750-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3860-767-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3860-3650-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3916-754-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/3948-772-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4028-751-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4036-3600-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4036-763-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4088-778-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4380-775-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4616-2237-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/4816-756-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5024-769-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5060-771-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5112-757-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5504-745-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5524-3386-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5540-2895-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5556-746-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/5608-3358-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/8528-2894-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/8580-3084-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/8632-2896-0x0000000000400000-0x00000000008CA000-memory.dmp

Download

memory/8816-3647-0x0000000000400000-0x00000000008CA000-memory.dmp

Download