amadey | 8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bfe3e23a74.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	axplong.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	af1363a830.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	07af863eee.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	07af863eee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	07af863eee.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bfe3e23a74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bfe3e23a74.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	af1363a830.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	axplong.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	af1363a830.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	axplong.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	Offnewhere.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	splwow64.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ogriIqEF.url	9924486828.exe

Executes dropped EXE 64 IoCs

pid	Process
4748	axplong.exe
4392	stealc_default2.exe
4160	Offnewhere.exe
1400	Gxtuum.exe
860	splwow64.exe
2320	Jurisdiction.pif
3980	new_v8.exe
1648	9924486828.exe
1364	bfe3e23a74.exe
4372	6nteyex7.exe
3640	RDX123456.exe
1632	axplong.exe
4008	Gxtuum.exe
3676	j4vzzuai.exe
468	j4vzzuai.exe
3872	18ijuw13.exe
3460	af1363a830.exe
4892	18ijuw13.exe
2980	07af863eee.exe
4520	6nteyex7.exe
1372	6nteyex7.exe
3068	6nteyex7.exe
2236	6nteyex7.exe
3076	6nteyex7.exe
1228	6nteyex7.exe
4764	6nteyex7.exe
4124	6nteyex7.exe
832	6nteyex7.exe
3660	6nteyex7.exe
1008	6nteyex7.exe
2088	6nteyex7.exe
4744	6nteyex7.exe
2784	6nteyex7.exe
3736	6nteyex7.exe
2892	6nteyex7.exe
1876	6nteyex7.exe
4796	6nteyex7.exe
1476	6nteyex7.exe
1716	6nteyex7.exe
2216	6nteyex7.exe
3016	6nteyex7.exe
3692	6nteyex7.exe
1632	6nteyex7.exe
4420	6nteyex7.exe
996	6nteyex7.exe
3460	6nteyex7.exe
1188	6nteyex7.exe
4524	6nteyex7.exe
3224	6nteyex7.exe
536	6nteyex7.exe
4364	6nteyex7.exe
2508	6nteyex7.exe
4356	6nteyex7.exe
5092	6nteyex7.exe
3404	6nteyex7.exe
3756	6nteyex7.exe
3652	6nteyex7.exe
4292	6nteyex7.exe
1108	6nteyex7.exe
4008	6nteyex7.exe
3600	6nteyex7.exe
4264	6nteyex7.exe
1048	6nteyex7.exe
540	6nteyex7.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	bfe3e23a74.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	axplong.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	af1363a830.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	07af863eee.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	Process not Found

Loads dropped DLL 2 IoCs

pid	Process
4392	stealc_default2.exe
4392	stealc_default2.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\af1363a830.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002043001\\af1363a830.exe"	axplong.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\07af863eee.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1002044001\\07af863eee.exe"	axplong.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
64	tasklist.exe
3792	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
4748	axplong.exe
1364	bfe3e23a74.exe
1632	axplong.exe
3460	af1363a830.exe
2980	07af863eee.exe
236776	Process not Found

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 468	3676	j4vzzuai.exe	138
PID 3872 set thread context of 4892	3872	18ijuw13.exe	146
PID 1648 set thread context of 194820	1648	9924486828.exe	23916

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\AdditionsSalvation	splwow64.exe
File opened for modification	C:\Windows\SixCream	splwow64.exe
File opened for modification	C:\Windows\HomelessLaser	splwow64.exe
File opened for modification	C:\Windows\ActuallyFtp	splwow64.exe
File opened for modification	C:\Windows\EauOfficial	splwow64.exe
File created	C:\Windows\Tasks\axplong.job	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
File created	C:\Windows\Tasks\Gxtuum.job	Offnewhere.exe
File opened for modification	C:\Windows\LuggageRepresentations	splwow64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

pid	pid_target	Process	procid_target
5004	1364	WerFault.exe	121
64	1364	WerFault.exe	121
2344	3676	WerFault.exe	136
1704	3872	WerFault.exe	142
1784	2980	WerFault.exe	150
265016	4372	Process not Found	131

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18ijuw13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18ijuw13.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	new_v8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	07af863eee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Jurisdiction.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RDX123456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j4vzzuai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	stealc_default2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Offnewhere.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	af1363a830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6nteyex7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	j4vzzuai.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	splwow64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bfe3e23a74.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	axplong.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	stealc_default2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	stealc_default2.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
4748	axplong.exe
4748	axplong.exe
4392	stealc_default2.exe
4392	stealc_default2.exe
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif
4392	stealc_default2.exe
4392	stealc_default2.exe
1364	bfe3e23a74.exe
1364	bfe3e23a74.exe
1632	axplong.exe
1632	axplong.exe
3460	af1363a830.exe
3460	af1363a830.exe
2980	07af863eee.exe
2980	07af863eee.exe
1648	9924486828.exe
1648	9924486828.exe
236776	Process not Found
236776	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	tasklist.exe
Token: SeDebugPrivilege	3792	tasklist.exe
Token: SeDebugPrivilege	1648	9924486828.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2320	Jurisdiction.pif
2320	Jurisdiction.pif
2320	Jurisdiction.pif

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1124 wrote to memory of 4748	1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe	87
PID 1124 wrote to memory of 4748	1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe	87
PID 1124 wrote to memory of 4748	1124	8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe	87
PID 4748 wrote to memory of 4392	4748	axplong.exe	88
PID 4748 wrote to memory of 4392	4748	axplong.exe	88
PID 4748 wrote to memory of 4392	4748	axplong.exe	88
PID 4748 wrote to memory of 4160	4748	axplong.exe	89
PID 4748 wrote to memory of 4160	4748	axplong.exe	89
PID 4748 wrote to memory of 4160	4748	axplong.exe	89
PID 4160 wrote to memory of 1400	4160	Offnewhere.exe	92
PID 4160 wrote to memory of 1400	4160	Offnewhere.exe	92
PID 4160 wrote to memory of 1400	4160	Offnewhere.exe	92
PID 4748 wrote to memory of 860	4748	axplong.exe	94
PID 4748 wrote to memory of 860	4748	axplong.exe	94
PID 4748 wrote to memory of 860	4748	axplong.exe	94
PID 860 wrote to memory of 2060	860	splwow64.exe	96
PID 860 wrote to memory of 2060	860	splwow64.exe	96
PID 860 wrote to memory of 2060	860	splwow64.exe	96
PID 2060 wrote to memory of 64	2060	cmd.exe	100
PID 2060 wrote to memory of 64	2060	cmd.exe	100
PID 2060 wrote to memory of 64	2060	cmd.exe	100
PID 2060 wrote to memory of 3532	2060	cmd.exe	101
PID 2060 wrote to memory of 3532	2060	cmd.exe	101
PID 2060 wrote to memory of 3532	2060	cmd.exe	101
PID 2060 wrote to memory of 3792	2060	cmd.exe	102
PID 2060 wrote to memory of 3792	2060	cmd.exe	102
PID 2060 wrote to memory of 3792	2060	cmd.exe	102
PID 2060 wrote to memory of 2444	2060	cmd.exe	103
PID 2060 wrote to memory of 2444	2060	cmd.exe	103
PID 2060 wrote to memory of 2444	2060	cmd.exe	103
PID 2060 wrote to memory of 5004	2060	cmd.exe	104
PID 2060 wrote to memory of 5004	2060	cmd.exe	104
PID 2060 wrote to memory of 5004	2060	cmd.exe	104
PID 2060 wrote to memory of 1912	2060	cmd.exe	105
PID 2060 wrote to memory of 1912	2060	cmd.exe	105
PID 2060 wrote to memory of 1912	2060	cmd.exe	105
PID 2060 wrote to memory of 3080	2060	cmd.exe	106
PID 2060 wrote to memory of 3080	2060	cmd.exe	106
PID 2060 wrote to memory of 3080	2060	cmd.exe	106
PID 2060 wrote to memory of 2320	2060	cmd.exe	107
PID 2060 wrote to memory of 2320	2060	cmd.exe	107
PID 2060 wrote to memory of 2320	2060	cmd.exe	107
PID 4748 wrote to memory of 3980	4748	axplong.exe	108
PID 4748 wrote to memory of 3980	4748	axplong.exe	108
PID 4748 wrote to memory of 3980	4748	axplong.exe	108
PID 2060 wrote to memory of 2800	2060	cmd.exe	109
PID 2060 wrote to memory of 2800	2060	cmd.exe	109
PID 2060 wrote to memory of 2800	2060	cmd.exe	109
PID 2320 wrote to memory of 2532	2320	Jurisdiction.pif	110
PID 2320 wrote to memory of 2532	2320	Jurisdiction.pif	110
PID 2320 wrote to memory of 2532	2320	Jurisdiction.pif	110
PID 2320 wrote to memory of 452	2320	Jurisdiction.pif	113
PID 2320 wrote to memory of 452	2320	Jurisdiction.pif	113
PID 2320 wrote to memory of 452	2320	Jurisdiction.pif	113
PID 2532 wrote to memory of 2936	2532	cmd.exe	115
PID 2532 wrote to memory of 2936	2532	cmd.exe	115
PID 2532 wrote to memory of 2936	2532	cmd.exe	115
PID 4748 wrote to memory of 1648	4748	axplong.exe	120
PID 4748 wrote to memory of 1648	4748	axplong.exe	120
PID 4748 wrote to memory of 1364	4748	axplong.exe	121
PID 4748 wrote to memory of 1364	4748	axplong.exe	121
PID 4748 wrote to memory of 1364	4748	axplong.exe	121
PID 4748 wrote to memory of 4372	4748	axplong.exe	131
PID 4748 wrote to memory of 4372	4748	axplong.exe	131

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3476
- C:\Users\Admin\AppData\Local\Temp\8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe
  "C:\Users\Admin\AppData\Local\Temp\8224b2dda012b7de72d162659e5869c9bb18e071a641d440eafb62e404ab32b6.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
    "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
      "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe
      "C:\Users\Admin\AppData\Local\Temp\1000477001\Offnewhere.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe
      "C:\Users\Admin\AppData\Local\Temp\1000817001\splwow64.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:860
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c copy Beijing Beijing.bat & Beijing.bat
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2060
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:64
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /I "wrsa opssvc"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3532
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3792
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2444
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c md 197036
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5004
      - C:\Windows\SysWOW64\findstr.exe
        
        findstr /V "CRAWFORDFILLEDVERIFYSCALE" Mtv
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1912
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c copy /b ..\Twisted + ..\Molecular + ..\Sponsorship + ..\Various + ..\Witch + ..\Spirit + ..\See + ..\Fitting T
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\197036\Jurisdiction.pif
        
        Jurisdiction.pif T
        6⤵
        Suspicious use of NtCreateUserProcessOtherParentProcess
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2320
      - C:\Windows\SysWOW64\choice.exe
        
        choice /d y /t 5
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
  - - C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe
      "C:\Users\Admin\AppData\Local\Temp\1000828001\new_v8.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3980
  - - C:\Users\Admin\AppData\Local\Temp\1000833001\9924486828.exe
      "C:\Users\Admin\AppData\Local\Temp\1000833001\9924486828.exe"
      4⤵
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\1000857001\bfe3e23a74.exe
      "C:\Users\Admin\AppData\Local\Temp\1000857001\bfe3e23a74.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1364
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1484
        5⤵
        Program crash
        
        PID:5004
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1364 -s 1472
        5⤵
        Program crash
        
        PID:64
  - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
      "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3068
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2088
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2784
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2892
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1876
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3016
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:996
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3756
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        Executes dropped EXE
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3028
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4436
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1724
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:544
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5552
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5728
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5816
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5872
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6064
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2620
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6312
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6408
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6544
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6680
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6808
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6968
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7624
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7728
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7848
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8112
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:440
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8212
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8260
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8572
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8716
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8740
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8756
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9524
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9652
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9764
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9980
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10116
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10272
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10368
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10504
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10520
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10528
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10552
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10640
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10792
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10832
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10848
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10872
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10888
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10904
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10936
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11016
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11048
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11080
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11088
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11128
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11144
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11160
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11232
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11676
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11852
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11884
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11892
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11908
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11980
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12084
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12100
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1000965001\6nteyex7.exe"
        5⤵
        
        PID:12228
  - - C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe
      "C:\Users\Admin\AppData\Local\Temp\1001096001\RDX123456.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\1001527001\j4vzzuai.exe
      "C:\Users\Admin\AppData\Local\Temp\1001527001\j4vzzuai.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3676
    - - C:\Users\Admin\AppData\Local\Temp\1001527001\j4vzzuai.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001527001\j4vzzuai.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:468
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3676 -s 300
        5⤵
        Program crash
        
        PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\1001858001\18ijuw13.exe
      "C:\Users\Admin\AppData\Local\Temp\1001858001\18ijuw13.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\1001858001\18ijuw13.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1001858001\18ijuw13.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4892
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3872 -s 276
        5⤵
        Program crash
        
        PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\1002043001\af1363a830.exe
      "C:\Users\Admin\AppData\Local\Temp\1002043001\af1363a830.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\1002044001\07af863eee.exe
      "C:\Users\Admin\AppData\Local\Temp\1002044001\07af863eee.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2980
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2980 -s 1472
        5⤵
        Program crash
        
        PID:1784
- C:\Windows\SysWOW64\cmd.exe
  cmd /c schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /create /tn "Wall" /tr "wscript //B 'C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js'" /sc minute /mo 5 /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2936
- C:\Windows\SysWOW64\cmd.exe
  cmd /k echo [InternetShortcut] > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & echo URL="C:\Users\Admin\AppData\Local\GreenTech Dynamics\EcoCraft.js" >> "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EcoCraft.url" & exit
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  PID:452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1364 -ip 1364
1⤵
PID:1836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1364 -ip 1364
1⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1632

C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
C:\Users\Admin\AppData\Local\Temp\23a0892ef8\Gxtuum.exe
1⤵
- Executes dropped EXE
PID:4008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3676 -ip 3676
1⤵
PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3872 -ip 3872
1⤵
PID:3600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2980 -ip 2980
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion