stealc | hxxps://www[.]modmenu[.]top/BrickRigs

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.modmenu.top/BrickRigs

Score

10^/10

stealc vidar 0488b9927a0f6f664c950978946c718c discovery execution stealer

Malware Config

Extracted

Family

vidar

Version

11.8

Botnet

0488b9927a0f6f664c950978946c718c

https://t.me/fu4chmo

https://steamcommunity.com/profiles/76561199802540894

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.6 Safari/605.1.15 Ddg/17.6

Signatures

Detect Vidar Stealer 2 IoCs

stealer

resource	yara_rule
behavioral1/memory/120704-351-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7
behavioral1/memory/120704-352-0x0000000000400000-0x0000000000659000-memory.dmp	family_vidar_v7

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4416	powershell.exe
107204	Process not Found
2988	powershell.exe
116576	Process not Found

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
5376	Installer.exe
3944	WN6ORD6E.exe
3968	WN6ORD6E.exe
5988	WN6ORD6E.exe
6004	WN6ORD6E.exe
5976	WN6ORD6E.exe
740	WN6ORD6E.exe
3076	WN6ORD6E.exe
6032	WN6ORD6E.exe
3084	WN6ORD6E.exe
2848	WN6ORD6E.exe
1420	WN6ORD6E.exe
6044	WN6ORD6E.exe
6052	WN6ORD6E.exe
6068	WN6ORD6E.exe
5584	WN6ORD6E.exe
6080	WN6ORD6E.exe
6096	WN6ORD6E.exe
6108	WN6ORD6E.exe
4360	WN6ORD6E.exe
6136	WN6ORD6E.exe
5504	WN6ORD6E.exe
4788	WN6ORD6E.exe
1764	WN6ORD6E.exe
1132	WN6ORD6E.exe
4568	WN6ORD6E.exe
4024	WN6ORD6E.exe
6028	WN6ORD6E.exe
1436	WN6ORD6E.exe
5564	WN6ORD6E.exe
5756	WN6ORD6E.exe
732	WN6ORD6E.exe
2856	WN6ORD6E.exe
2160	WN6ORD6E.exe
1616	WN6ORD6E.exe
3472	WN6ORD6E.exe
1148	WN6ORD6E.exe
5088	WN6ORD6E.exe
2096	WN6ORD6E.exe
5044	WN6ORD6E.exe
932	WN6ORD6E.exe
5156	WN6ORD6E.exe
1224	WN6ORD6E.exe
5748	WN6ORD6E.exe
5184	WN6ORD6E.exe
5340	WN6ORD6E.exe
1724	WN6ORD6E.exe
3216	WN6ORD6E.exe
5276	WN6ORD6E.exe
5300	WN6ORD6E.exe
5328	WN6ORD6E.exe
1092	WN6ORD6E.exe
5368	WN6ORD6E.exe
2108	WN6ORD6E.exe
4588	WN6ORD6E.exe
1532	WN6ORD6E.exe
4296	WN6ORD6E.exe
1400	WN6ORD6E.exe
1504	WN6ORD6E.exe
5352	WN6ORD6E.exe
5356	WN6ORD6E.exe
5396	WN6ORD6E.exe
4320	WN6ORD6E.exe
1156	WN6ORD6E.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
121132	118232	Process not Found	14343

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WN6ORD6E.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7za.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Installer.exe

Delays execution with timeout.exe 4 IoCs

evasion

pid	Process
5388	timeout.exe
5400	timeout.exe
63296	Process not Found
69200	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4472	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
5092	msedge.exe
5092	msedge.exe
2872	identity_helper.exe
2872	identity_helper.exe
1876	msedge.exe
1876	msedge.exe
4416	powershell.exe
4416	powershell.exe
4416	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
31188	Process not Found
31188	Process not Found
31188	Process not Found
31188	Process not Found

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3772	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	5800	7zG.exe
Token: 35	5800	7zG.exe
Token: SeSecurityPrivilege	5800	7zG.exe
Token: SeSecurityPrivilege	5800	7zG.exe
Token: SeRestorePrivilege	5972	7zG.exe
Token: 35	5972	7zG.exe
Token: SeSecurityPrivilege	5972	7zG.exe
Token: SeSecurityPrivilege	5972	7zG.exe
Token: SeRestorePrivilege	1532	7za.exe
Token: 35	1532	7za.exe
Token: SeSecurityPrivilege	1532	7za.exe
Token: SeSecurityPrivilege	1532	7za.exe
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	5376	Installer.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeRestorePrivilege	63168	Process not Found
Token: 35	63168	Process not Found
Token: SeSecurityPrivilege	63168	Process not Found
Token: SeSecurityPrivilege	63168	Process not Found

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5800	7zG.exe
5972	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe
3772	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 3880	5092	msedge.exe	83
PID 5092 wrote to memory of 3880	5092	msedge.exe	83
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 2544	5092	msedge.exe	85
PID 5092 wrote to memory of 3280	5092	msedge.exe	86
PID 5092 wrote to memory of 3280	5092	msedge.exe	86
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87
PID 5092 wrote to memory of 1580	5092	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://www.modmenu.top/BrickRigs
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd71646f8,0x7ffcd7164708,0x7ffcd7164718
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,3228022603367066520,9984806586922033724,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:60

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5680

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap30400:134:7zEvent10574
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5800

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\BrickRigs__Application_673dcfb775702\" -spe -an -ai#7zMap11601:134:7zEvent28774
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5972

C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\Setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\Setup.exe"
1⤵
PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\data\extract_and_run.bat
  2⤵
  PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\data\7za.exe
    7za.exe e bin.zip -pYOUR_PASSWORD -oextracted_9687
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\data\extracted_9687\Installer.exe
    "extracted_9687\Installer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5376
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -Command " try { Set-MpPreference -DisableRealtimeMonitoring $true Add-MpPreference -ExclusionPath 'C:\' } catch { Write-Error 'Failed to modify Defender settings.' } "
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4416
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -Command "Start-Process 'C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2988
    - - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3968
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5988
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6004
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5976
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:740
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3076
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3084
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:2848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1420
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6044
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6052
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6068
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5584
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6108
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4788
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1764
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1132
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4568
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4024
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:6028
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1436
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5564
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5756
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:732
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:2856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:2160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1616
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1148
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5088
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:2096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5044
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:932
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5156
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5748
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5340
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1724
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:3216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5276
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5300
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1092
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:2108
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4588
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1532
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5356
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:5396
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:4320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        Executes dropped EXE
        
        PID:1156
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4260
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4612
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1500
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:748
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4172
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1040
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:720
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3728
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1192
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4204
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:552
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4500
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3060
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3776
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:2496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:1656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10600
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10688
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10720
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10824
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10936
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10952
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10984
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:10992
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11024
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11032
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11040
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11200
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11548
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11604
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11612
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12124
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12132
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12416
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12528
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12536
      - C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe
        
        "C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe"
        6⤵
        
        PID:12544
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:5400

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3772
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\mapistub.dll
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
5361aa3e61ead1c27a67d990e69aad3d

SHA1
f1032121abbdf5214945f05bdc57ec6fbd0fe623

SHA256
823cccde31c958013884fef2885416f9353170250cfa2d32fd56cccbe03eb84d

SHA512
30a520dfe7574c95484fb65b31c95950cef9ecebcb05cc203d95e8a6efdfd174ac6ddbd60e7bffe7a468fefef9c20dfc75e173926ccae42ea56757d191c691c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
400B

MD5
29e8e6dbf1dfe617ce25e8475399774e

SHA1
f949103086dc31507e8e0cb090d0ac27f27486c7

SHA256
4fad78ad238063b122c67623910b7362f32e133824e03e4223d3cf8771574dd6

SHA512
496e425e14dea3e47d07b712b424997820075c584e5c85f5065399315527c875640154664024de56a25d2b8af3e1e9a1eb483a1f7f77cb569cc1daf37a3cccb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8ffb257682d773e853d733caea779042

SHA1
92a00d174ab63ecb685b7592522854225326bf7f

SHA256
5b96f149f3fb4d8eedea81f6f601a6b8eedad366a9bf3bdb8db4b6b842f937c2

SHA512
3fc4a835093e60cfec443c2650ba5219d2d80f33043e40bd06a376b7f3380f23b6f59441ca151b6d16cb46e5e30f7a316384bf6551a19ad8e0820a03cbf765de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0e06db11bc8d7f2006cb4fd4e9e078f

SHA1
fbfb796f5694f0557d158554af2123ed3fb38c7d

SHA256
c2b40693456860fb6045e4b68685666badbc75829a651ae01c6cba913c2e47dc

SHA512
be1117ceda9ceaa1b32bac5c2dfa6d4e848423fbca00cbde4f342c4eaad9bb1c03fe1051a1d84448b5825c30faf361d90adb7b9b3011efe0d5369e5e2f1701e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5ee30d4e29d6244ca84f5f5adc6132f4

SHA1
47da6a8e05f1874204c1bb8b0916ed827eb3b7eb

SHA256
b0c317817bdce8836583e4314663a1919842fc3c8510a9fbbd8e02905a8505df

SHA512
2d09c4ed03392dc56cef91b3cec5dfbc61f77d47f6d13add4d3a88ac8e0f181fe039ef7242809e5f0ac31828a4e8dcc2e2f2d5dd5141bea8902e0c485adc2d22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a50283a7540bb1c6d4d366d4c4d712ef

SHA1
68ddae74d15758a906dde53c267bc79325dc0f96

SHA256
445b2775699a72277835e393ac6e7029c71c6338e6e0c499a21b5c1f83b91be3

SHA512
007c59d68ef3d3f1cfb0db99ed1960d17dc2e53d0a395c68592c417a88d58129db7ee111e111bf3d0bbd1512faef39521c77d9dc6db7c03ec795ca5c82956c16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8d073342d5ed971567c6029a39972f0

SHA1
8c9bb10a62423f41967d2924309fb3cd8a4f8508

SHA256
6159b2ed4031122282dc0e01080179e996597831a04abb272328b4b5438b1648

SHA512
28a89d641f17ffa7cf94ddcaa63254ac30546168e1e1813673dc548a7270dcd196751a5f8c17498adee2f130707e7e3e236aa1b2111df159ff3859bb8b28295c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
1d5fbf911e2059b381684818e59f104c

SHA1
11eb541e08a5e3787c5c2f023a56f9943b703534

SHA256
e876176e90cde25e985935ca1cb77382af8f9a38a2c732047a83191a86f57127

SHA512
ce4bd312bfa2bf970c753db56e0fcc0a60f8856d70b7177854ccec55b61ad05df4d70138c73bb07929c8f46567203867c75a12c793ad3364430ab694cd0691a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\data\extract_and_run.bat

Filesize
1KB

MD5
4738a489db8bc4e89e2e2819c1f1c636

SHA1
8fa59313986c78cf712ac9049a63e702806c9e08

SHA256
d9ef1159e51e9214d90e0f9976ad640e2722dd42a3e2792f7e333f74fd77db78

SHA512
c8a3712ec6dd3650da42457c9e01d120816195fd900ab8dff9fb8ab01954bf4fd841e732c426ce376923f62e7d20f1fb184e297c815d8f8ea31957b02a192f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_app.zip\data\extracted_9687\Installer.exe

Filesize
11KB

MD5
8388bc2aa20dde7a8fc77e915e229700

SHA1
1d8ae66a6a09d969ae425b96726c26a01b9e1806

SHA256
e4100110275f73c76b00d0e0231e4d78dc61af55c2fc9ed6938d9621aa3c1ba8

SHA512
b34dca4a5d8e6178080c00462a56ec598de251ce0e16dde3fb16ec87f6122503b5e1f55cfd9051a6e3becee0217d2edf41afb8510f5390a3e0778e2d8554076e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hxe4kf4x.azc.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\WN6ORD6E.exe

Filesize
976KB

MD5
f223c403141b9b08d760fa4def744f8e

SHA1
b25c8d3b21b46a3e90729bbacc1c3de3211826e6

SHA256
6f642e855ee75fb6240360009af862a3411eb4e69cbd159d05b9f0b15464af69

SHA512
f56f743c9c9f61b7701e6214eb184442fb32dfa5fa5420d2dde499da5fda04f6ead6ecbd79ee06d6eeb4a8fe6735d47310198f4dd443d9045eeaa288517880ff

Download Submit
memory/2988-255-0x0000000008180000-0x0000000008724000-memory.dmp

Filesize
5.6MB

Download
memory/2988-254-0x0000000007BA0000-0x0000000007BC2000-memory.dmp

Filesize
136KB

Download
memory/2988-253-0x0000000006A20000-0x0000000006A6C000-memory.dmp

Filesize
304KB

Download
memory/2988-251-0x0000000006470000-0x00000000067C4000-memory.dmp

Filesize
3.3MB

Download
memory/4416-214-0x0000000006560000-0x00000000065AC000-memory.dmp

Filesize
304KB

Download
memory/4416-235-0x0000000007BC0000-0x0000000007BDA000-memory.dmp

Filesize
104KB

Download
memory/4416-215-0x0000000007510000-0x0000000007542000-memory.dmp

Filesize
200KB

Download
memory/4416-216-0x0000000070DE0000-0x0000000070E2C000-memory.dmp

Filesize
304KB

Download
memory/4416-226-0x0000000006AF0000-0x0000000006B0E000-memory.dmp

Filesize
120KB

Download
memory/4416-227-0x0000000007750000-0x00000000077F3000-memory.dmp

Filesize
652KB

Download
memory/4416-228-0x0000000007EE0000-0x000000000855A000-memory.dmp

Filesize
6.5MB

Download
memory/4416-229-0x0000000007890000-0x00000000078AA000-memory.dmp

Filesize
104KB

Download
memory/4416-230-0x00000000078F0000-0x00000000078FA000-memory.dmp

Filesize
40KB

Download
memory/4416-231-0x0000000007B20000-0x0000000007BB6000-memory.dmp

Filesize
600KB

Download
memory/4416-232-0x0000000007A90000-0x0000000007AA1000-memory.dmp

Filesize
68KB

Download
memory/4416-233-0x0000000007AC0000-0x0000000007ACE000-memory.dmp

Filesize
56KB

Download
memory/4416-234-0x0000000007AD0000-0x0000000007AE4000-memory.dmp

Filesize
80KB

Download
memory/4416-213-0x0000000006540000-0x000000000655E000-memory.dmp

Filesize
120KB

Download
memory/4416-236-0x0000000007B00000-0x0000000007B08000-memory.dmp

Filesize
32KB

Download
memory/4416-209-0x0000000005FC0000-0x0000000006314000-memory.dmp

Filesize
3.3MB

Download
memory/4416-202-0x0000000005F50000-0x0000000005FB6000-memory.dmp

Filesize
408KB

Download
memory/4416-201-0x0000000005DB0000-0x0000000005E16000-memory.dmp

Filesize
408KB

Download
memory/4416-200-0x00000000055B0000-0x00000000055D2000-memory.dmp

Filesize
136KB

Download
memory/4416-199-0x0000000005610000-0x0000000005C38000-memory.dmp

Filesize
6.2MB

Download
memory/4416-198-0x0000000004FA0000-0x0000000004FD6000-memory.dmp

Filesize
216KB

Download
memory/5376-179-0x0000000000860000-0x000000000086A000-memory.dmp

Filesize
40KB

Download
memory/107204-310-0x0000000005F90000-0x00000000062E4000-memory.dmp

Filesize
3.3MB

Download
memory/107204-320-0x0000000070DE0000-0x0000000070E2C000-memory.dmp

Filesize
304KB

Download
memory/120704-351-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download
memory/120704-352-0x0000000000400000-0x0000000000659000-memory.dmp

Filesize
2.3MB

Download