amadey | 7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79

Analysis

max time kernel
118s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2024 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Size

1.8MB
MD5

73d71ec379a8f5978f4d1eaee373e5b0
SHA1

32c309bc28ecf5a1bbcdd8f68af4c7f2679cc90c
SHA256

7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79
SHA512

00829c741b1c8a14dfb3fd49b401924d9b907915c9be4576355c6f5ce895e6ee8a62fb1cb9b5f6626c17b09530a97ab3b5b9e82560b3f7d47f663b8ef3efc202
SSDEEP

49152:4FCqIhjny2gD4deftUZzmPujFmGM0+OpNljjG:4FCqIRy7D3tEu83DF

Score

10^/10

amadey cryptbot lumma redline stealc 1176f2 default_valenciga fed3aa tg cloud @rlreborn admin @fatherofcarders credential_access discovery evasion infostealer spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

http://185.215.113.16

Attributes

install_dir
44111dbc49
install_file
axplong.exe
strings_key
8d0ad6945b1a30a186ec2d30be6db0b5
url_paths
/Jo89Ku7d/index.php

rc4.plain

Extracted

Family

stealc

Botnet

default_valenciga

http://185.215.113.17

Attributes

url_path
/2fb6c2cc8dce150a.php

Extracted

Family

lumma

https://snailyeductyi.sbs

https://ferrycheatyk.sbs

https://deepymouthi.sbs

https://wrigglesight.sbs

https://captaitwik.sbs

https://sidercotay.sbs

https://heroicmint.sbs

https://monstourtu.sbs

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

89.105.223.196:29155

Extracted

Family

amadey

Version

4.41

Botnet

1176f2

http://185.215.113.19

Attributes

install_dir
417fd29867
install_file
ednfoki.exe
strings_key
183201dc3defc4394182b4bff63c4065
url_paths
/CoreOPT/index.php

rc4.plain

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 1 IoCs

resource	yara_rule
behavioral2/memory/32292-273-0x0000000000400000-0x0000000000452000-memory.dmp	family_redline

Stealc
Stealc is an infostealer written in C++.
stealer stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 4 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
151348	Process not Found
149880	Process not Found
151020	Process not Found
151012	Process not Found

Checks BIOS information in registry 2 TTPs 8 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Process not Found
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	processclass.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Process not Found
Key value queried	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation	Process not Found

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	Process not Found
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Office Manager.url	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
1340	axplong.exe
1688	pvp.exe
2948	stealc_default2.exe
4060	pvp.exe
3928	pvp.exe
3120	pvp.exe
1508	pvp.exe
4416	pvp.exe
912	pvp.exe
4860	pvp.exe
2888	pvp.exe
1876	pvp.exe
4808	pvp.exe
4312	pvp.exe
1176	pvp.exe
1132	pvp.exe
4128	pvp.exe
452	pvp.exe
2624	pvp.exe
4448	pvp.exe
2096	pvp.exe
2504	pvp.exe
100	pvp.exe
384	pvp.exe
1028	pvp.exe
1868	pvp.exe
3240	pvp.exe
2324	pvp.exe
2908	pvp.exe
1964	pvp.exe
1056	pvp.exe
3880	pvp.exe
2956	pvp.exe
4300	pvp.exe
1292	pvp.exe
1960	pvp.exe
648	pvp.exe
2328	pvp.exe
3600	pvp.exe
4400	pvp.exe
3960	pvp.exe
4824	pvp.exe
1968	pvp.exe
1888	pvp.exe
1628	pvp.exe
2828	pvp.exe
2128	pvp.exe
2772	pvp.exe
1152	pvp.exe
1060	pvp.exe
4716	pvp.exe
3080	pvp.exe
4844	pvp.exe
2152	pvp.exe
2652	pvp.exe
4628	pvp.exe
3508	pvp.exe
3440	pvp.exe
2184	pvp.exe
3980	pvp.exe
1936	pvp.exe
4644	pvp.exe
2428	pvp.exe
1764	pvp.exe

Identifies Wine through registry keys 2 TTPs 4 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Wine	Process not Found

Loads dropped DLL 4 IoCs

pid	Process
2948	stealc_default2.exe
2948	stealc_default2.exe
194100	Process not Found
265528	Process not Found

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
1340	axplong.exe
64208	Process not Found
265380	Process not Found

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 22828 set thread context of 23172	22828	Process not Found	2460
PID 31492 set thread context of 32292	31492	Process not Found	3577
PID 19964 set thread context of 90320	19964	Process not Found	10818
PID 68156 set thread context of 149268	68156	Process not Found	18166

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\axplong.job	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
File created	C:\Windows\Tasks\Hkbsse.job	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral2/files/0x0007000000023ccf-361.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
23668	22828	Process not Found	2419
32424	31492	Process not Found	3504
265316	1688	Process not Found	90

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pvp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
93556	Process not Found
152036	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Process not Found

Kills process with taskkill 2 IoCs

evasion

pid	Process
93228	Process not Found
151336	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
196600	Process not Found

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
1340	axplong.exe
1340	axplong.exe
2948	stealc_default2.exe
2948	stealc_default2.exe
32292	Process not Found
32292	Process not Found
32292	Process not Found
32292	Process not Found
64208	Process not Found
64208	Process not Found
2948	stealc_default2.exe
2948	stealc_default2.exe
19964	Process not Found
19964	Process not Found
149880	Process not Found
149880	Process not Found
265380	Process not Found
265380	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
149880	Process not Found
149880	Process not Found
149880	Process not Found

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	32292	Process not Found
Token: SeDebugPrivilege	11252	processclass.exe
Token: SeDebugPrivilege	19964	Process not Found
Token: SeDebugPrivilege	93228	Process not Found
Token: SeDebugPrivilege	68156	Process not Found
Token: SeDebugPrivilege	151336	Process not Found
Token: SeShutdownPrivilege	149880	Process not Found
Token: SeCreatePagefilePrivilege	149880	Process not Found
Token: SeShutdownPrivilege	149880	Process not Found
Token: SeCreatePagefilePrivilege	149880	Process not Found

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found
149880	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 1340	3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe	87
PID 3540 wrote to memory of 1340	3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe	87
PID 3540 wrote to memory of 1340	3540	7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe	87
PID 1340 wrote to memory of 1688	1340	axplong.exe	90
PID 1340 wrote to memory of 1688	1340	axplong.exe	90
PID 1340 wrote to memory of 1688	1340	axplong.exe	90
PID 1340 wrote to memory of 2948	1340	axplong.exe	93
PID 1340 wrote to memory of 2948	1340	axplong.exe	93
PID 1340 wrote to memory of 2948	1340	axplong.exe	93
PID 1688 wrote to memory of 4060	1688	pvp.exe	94
PID 1688 wrote to memory of 4060	1688	pvp.exe	94
PID 1688 wrote to memory of 4060	1688	pvp.exe	94
PID 1688 wrote to memory of 3120	1688	pvp.exe	95
PID 1688 wrote to memory of 3120	1688	pvp.exe	95
PID 1688 wrote to memory of 3120	1688	pvp.exe	95
PID 1688 wrote to memory of 1508	1688	pvp.exe	96
PID 1688 wrote to memory of 1508	1688	pvp.exe	96
PID 1688 wrote to memory of 1508	1688	pvp.exe	96
PID 1688 wrote to memory of 3928	1688	pvp.exe	97
PID 1688 wrote to memory of 3928	1688	pvp.exe	97
PID 1688 wrote to memory of 3928	1688	pvp.exe	97
PID 1688 wrote to memory of 4416	1688	pvp.exe	98
PID 1688 wrote to memory of 4416	1688	pvp.exe	98
PID 1688 wrote to memory of 4416	1688	pvp.exe	98
PID 1688 wrote to memory of 912	1688	pvp.exe	99
PID 1688 wrote to memory of 912	1688	pvp.exe	99
PID 1688 wrote to memory of 912	1688	pvp.exe	99
PID 1688 wrote to memory of 4860	1688	pvp.exe	100
PID 1688 wrote to memory of 4860	1688	pvp.exe	100
PID 1688 wrote to memory of 4860	1688	pvp.exe	100
PID 1688 wrote to memory of 2888	1688	pvp.exe	101
PID 1688 wrote to memory of 2888	1688	pvp.exe	101
PID 1688 wrote to memory of 2888	1688	pvp.exe	101
PID 1688 wrote to memory of 1876	1688	pvp.exe	102
PID 1688 wrote to memory of 1876	1688	pvp.exe	102
PID 1688 wrote to memory of 1876	1688	pvp.exe	102
PID 1688 wrote to memory of 4808	1688	pvp.exe	103
PID 1688 wrote to memory of 4808	1688	pvp.exe	103
PID 1688 wrote to memory of 4808	1688	pvp.exe	103
PID 1688 wrote to memory of 4312	1688	pvp.exe	104
PID 1688 wrote to memory of 4312	1688	pvp.exe	104
PID 1688 wrote to memory of 4312	1688	pvp.exe	104
PID 1688 wrote to memory of 1176	1688	pvp.exe	105
PID 1688 wrote to memory of 1176	1688	pvp.exe	105
PID 1688 wrote to memory of 1176	1688	pvp.exe	105
PID 1688 wrote to memory of 1132	1688	pvp.exe	106
PID 1688 wrote to memory of 1132	1688	pvp.exe	106
PID 1688 wrote to memory of 1132	1688	pvp.exe	106
PID 1688 wrote to memory of 4128	1688	pvp.exe	107
PID 1688 wrote to memory of 4128	1688	pvp.exe	107
PID 1688 wrote to memory of 4128	1688	pvp.exe	107
PID 1688 wrote to memory of 452	1688	pvp.exe	108
PID 1688 wrote to memory of 452	1688	pvp.exe	108
PID 1688 wrote to memory of 452	1688	pvp.exe	108
PID 1688 wrote to memory of 2624	1688	pvp.exe	109
PID 1688 wrote to memory of 2624	1688	pvp.exe	109
PID 1688 wrote to memory of 2624	1688	pvp.exe	109
PID 1688 wrote to memory of 4448	1688	pvp.exe	110
PID 1688 wrote to memory of 4448	1688	pvp.exe	110
PID 1688 wrote to memory of 4448	1688	pvp.exe	110
PID 1688 wrote to memory of 2096	1688	pvp.exe	111
PID 1688 wrote to memory of 2096	1688	pvp.exe	111
PID 1688 wrote to memory of 2096	1688	pvp.exe	111
PID 1688 wrote to memory of 2504	1688	pvp.exe	112

C:\Users\Admin\AppData\Local\Temp\7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe
"C:\Users\Admin\AppData\Local\Temp\7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79N.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
  "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
    "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:912
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2624
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2096
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:100
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:384
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1868
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2908
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1964
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4300
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:648
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2772
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1060
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4844
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3440
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      Executes dropped EXE
      PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1032
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1580
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1240
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:972
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5020
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1696
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2408
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4404
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7196
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7244
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7260
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7316
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7396
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7460
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7524
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7532
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7588
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7636
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7684
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7692
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7708
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7716
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7828
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7852
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7868
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7940
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7956
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8012
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8044
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8100
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8124
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8156
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9236
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9284
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9292
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9356
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9364
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9380
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9388
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9428
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9460
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9468
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9484
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9492
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9564
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9588
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9676
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9700
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9764
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9772
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9788
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9812
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9828
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9916
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9956
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9980
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10004
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10012
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10020
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10052
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10092
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10140
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10148
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10156
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10368
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:10992
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11104
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11188
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:1012
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11308
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11316
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11428
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11444
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11668
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11700
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11708
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11732
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11756
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11776
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11908
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11956
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12024
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12032
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12144
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12152
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12160
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12184
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12192
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12208
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12224
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12240
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12248
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12280
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3812
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:11268
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2272
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:2644
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12312
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12344
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12352
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe
      "C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe"
      4⤵
      PID:12416
- - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
    "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
    "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
    3⤵
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:11252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000004001\pvp.exe

Filesize
1.3MB

MD5
d419a0a5a81da8360c3db8c358e7492e

SHA1
a4fa4a9cd4143b152c52c678dd2433379d5c5b7b

SHA256
c8718abc923b7a8f552445edb5a69ff56c76cd73d4703ec8acfe02a0ce0cb5b2

SHA512
8b02a250070de14eebcdea2688302bf0701005cbb64d89684fb45da1284828bda89241beab60565c1c8d6c4a20c5f5510afda92aa170babb6dc8efba087c023e

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe

Filesize
307KB

MD5
68a99cf42959dc6406af26e91d39f523

SHA1
f11db933a83400136dc992820f485e0b73f1b933

SHA256
c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

SHA512
7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000099001\2927.exe

Filesize
1KB

MD5
5343c1a8b203c162a3bf3870d9f50fd4

SHA1
04b5b886c20d88b57eea6d8ff882624a4ac1e51d

SHA256
dc1d54dab6ec8c00f70137927504e4f222c8395f10760b6beecfcfa94e08249f

SHA512
e0f50acb6061744e825a4051765cebf23e8c489b55b190739409d8a79bb08dac8f919247a4e5f65a015ea9c57d326bbef7ea045163915129e01f316c4958d949

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000100001\JavUmar1.exe

Filesize
12.2MB

MD5
b4a7565f5fe7f3fa54fa55734c050695

SHA1
cb059c204ec0c030e29d41cddc7bc7e96a552b20

SHA256
e1475c8d8760880e5d874a7bacb983cedda7691e507f7b1f89269333063239cc

SHA512
72591ddf64e0d14dbb717ebeaf12feb559e49309541ab7035b3ea3f3005e25a8533a934764cc1bd6befe820c3e8d8371e356f68de3aee6a67f1e1b7d7f9e61ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000354001\a91acff170.exe

Filesize
277B

MD5
d052d5386c0cea6928e36a0eea7cb777

SHA1
f01c44f9773efa1b5262956f225d24b1076fd2ff

SHA256
d96c85af3bdfc77361de9732c018a7bc7c623771e9a29331c793b6f9ff399fd0

SHA512
b8490ff4534ceca05c8ffe0a1f753681951d94117a5a6a06639f1372df9d45f0fc2402f7126526c88e911e4c73ea64917212bb07716b3bbb0d2ff6d9de52e05f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe

Filesize
6KB

MD5
c042782226565f89ce3954489075e516

SHA1
256dd5ba42837a33c7aa6cb71cef33d5617117ee

SHA256
a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

SHA512
9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe

Filesize
1.1MB

MD5
ed9393d5765529c845c623e35c1b1a34

SHA1
d3eca07f5ce0df847070d2d7fe5253067f624285

SHA256
53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

SHA512
565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000474001\golden.exe

Filesize
551KB

MD5
3a0f1fe734b215e85f47816085e425c9

SHA1
30a3ddb576c2f0eeb1bfc718b30266123eb1e474

SHA256
ec189d42b19d842d94772287dd02c5b2a2a6a79fce75f2f132111820646b8fba

SHA512
840546dbba54a94452eaf069dbbb53fd00fdf42dff20ce5722226a1a25b7410731dfd7ad01c04ca97b269aabbd46cead03cd82e52ed49ba6ea1f6c5bdba37189

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000477001\Newofff.exe

Filesize
416KB

MD5
f5d7b79ee6b6da6b50e536030bcc3b59

SHA1
751b555a8eede96d55395290f60adc43b28ba5e2

SHA256
2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

SHA512
532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

Download Submit
C:\Users\Admin\AppData\Local\Temp\1000478001\black123.exe

Filesize
515KB

MD5
a904ae8b26c7d421140be930266ed425

SHA1
c2e246b9197c18d6d40d9477a8e9a2d74a83b0e2

SHA256
9d3380ee1ccaae63ca9f39e86630ffe877d0e3ecb711d87dc02350922595dc84

SHA512
2dbd601a564f7ffc1609bfb05ed55d57afb9bdd9bec1e9091deb53fcfa9fa02a7ba59825f2b9c3777d2016d724a8263808331356f569a1ecae585422e040f3be

Download Submit
C:\Users\Admin\AppData\Local\Temp\227495264221

Filesize
83KB

MD5
469e5a2821a00c8c1b7f9fae0dc6d331

SHA1
aa7225293c16bc672c6c04aa549a289c69918146

SHA256
69974007d3ccdf02ddc3e87951bc6da5cec3cb6b907ff75c08510c214f2b66af

SHA512
6289b2cf2f8f0d0860f3267ab168dacc12e0821029175bd2e7277f5fa367358f50856a84b647ef58cfb7af3270c4ea44d4e1653409438902965d917c7d04c457

Download Submit
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe

Filesize
1.8MB

MD5
73d71ec379a8f5978f4d1eaee373e5b0

SHA1
32c309bc28ecf5a1bbcdd8f68af4c7f2679cc90c

SHA256
7b1f4d77a49f553382275a65dcb0154b4796b46314509a0893916cd567684e79

SHA512
00829c741b1c8a14dfb3fd49b401924d9b907915c9be4576355c6f5ce895e6ee8a62fb1cb9b5f6626c17b09530a97ab3b5b9e82560b3f7d47f663b8ef3efc202

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpD726.tmp

Filesize
2KB

MD5
1420d30f964eac2c85b2ccfe968eebce

SHA1
bdf9a6876578a3e38079c4f8cf5d6c79687ad750

SHA256
f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

SHA512
6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

Download Submit
memory/1340-21-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-19-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-468-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-465-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-356-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-169-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-462-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-370-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-315-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-149-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-455-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-16-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-451-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-440-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-20-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-437-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-209-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-210-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/1340-18-0x0000000000911000-0x000000000093F000-memory.dmp

Filesize
184KB

Download
memory/1688-67-0x00000000003F5000-0x00000000003F6000-memory.dmp

Filesize
4KB

Download
memory/1688-302-0x00000000003F5000-0x00000000003F6000-memory.dmp

Filesize
4KB

Download
memory/2948-211-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2948-58-0x00000000004A0000-0x0000000000701000-memory.dmp

Filesize
2.4MB

Download
memory/2948-345-0x00000000004A0000-0x0000000000701000-memory.dmp

Filesize
2.4MB

Download
memory/3540-15-0x0000000000590000-0x0000000000A52000-memory.dmp

Filesize
4.8MB

Download
memory/3540-4-0x0000000000590000-0x0000000000A52000-memory.dmp

Filesize
4.8MB

Download
memory/3540-3-0x0000000000590000-0x0000000000A52000-memory.dmp

Filesize
4.8MB

Download
memory/3540-2-0x0000000000591000-0x00000000005BF000-memory.dmp

Filesize
184KB

Download
memory/3540-0-0x0000000000590000-0x0000000000A52000-memory.dmp

Filesize
4.8MB

Download
memory/3540-1-0x00000000774D4000-0x00000000774D6000-memory.dmp

Filesize
8KB

Download
memory/11252-148-0x0000000000480000-0x0000000000488000-memory.dmp

Filesize
32KB

Download
memory/19964-168-0x0000000005190000-0x0000000005222000-memory.dmp

Filesize
584KB

Download
memory/19964-166-0x0000000000690000-0x00000000007A8000-memory.dmp

Filesize
1.1MB

Download
memory/19964-184-0x000000000B3A0000-0x000000000B424000-memory.dmp

Filesize
528KB

Download
memory/19964-170-0x0000000005280000-0x000000000528A000-memory.dmp

Filesize
40KB

Download
memory/19964-167-0x0000000005660000-0x0000000005C04000-memory.dmp

Filesize
5.6MB

Download
memory/23172-185-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/23172-186-0x0000000000400000-0x0000000000462000-memory.dmp

Filesize
392KB

Download
memory/32292-296-0x0000000007410000-0x0000000007422000-memory.dmp

Filesize
72KB

Download
memory/32292-298-0x00000000074B0000-0x00000000074FC000-memory.dmp

Filesize
304KB

Download
memory/32292-312-0x0000000009C80000-0x0000000009CD0000-memory.dmp

Filesize
320KB

Download
memory/32292-295-0x0000000008DA0000-0x0000000008EAA000-memory.dmp

Filesize
1.0MB

Download
memory/32292-297-0x0000000007470000-0x00000000074AC000-memory.dmp

Filesize
240KB

Download
memory/32292-290-0x00000000064B0000-0x0000000006526000-memory.dmp

Filesize
472KB

Download
memory/32292-294-0x0000000007520000-0x0000000007B38000-memory.dmp

Filesize
6.1MB

Download
memory/32292-314-0x000000000A8A0000-0x000000000ADCC000-memory.dmp

Filesize
5.2MB

Download
memory/32292-306-0x0000000008F90000-0x0000000008FF6000-memory.dmp

Filesize
408KB

Download
memory/32292-313-0x000000000A1A0000-0x000000000A362000-memory.dmp

Filesize
1.8MB

Download
memory/32292-291-0x0000000006B90000-0x0000000006BAE000-memory.dmp

Filesize
120KB

Download
memory/32292-273-0x0000000000400000-0x0000000000452000-memory.dmp

Filesize
328KB

Download
memory/64208-320-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/90320-347-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/90320-355-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/90320-346-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/90320-348-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/98796-438-0x0000000000B20000-0x000000000175E000-memory.dmp

Filesize
12.2MB

Download
memory/98796-450-0x0000000000B20000-0x000000000175E000-memory.dmp

Filesize
12.2MB

Download
memory/98796-371-0x0000000000B20000-0x000000000175E000-memory.dmp

Filesize
12.2MB

Download
memory/149268-374-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/149268-373-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/149268-395-0x0000000000400000-0x0000000000471000-memory.dmp

Filesize
452KB

Download
memory/194100-453-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download
memory/194100-454-0x000000006F520000-0x000000006F654000-memory.dmp

Filesize
1.2MB

Download
memory/265380-458-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/265380-456-0x0000000000910000-0x0000000000DD2000-memory.dmp

Filesize
4.8MB

Download
memory/265528-459-0x0000000000110000-0x0000000000122000-memory.dmp

Filesize
72KB

Download