amadey | 4832db62e582a4f94a082189971f43e6570517486ea799a7661f795257e920cf

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-12-2024 03:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.8MB
MD5

5bf4d30eee7b7951072135193f435f40
SHA1

b0b712d7020ded9b13601c808d8e32a8a0a3cc3e
SHA256

4832db62e582a4f94a082189971f43e6570517486ea799a7661f795257e920cf
SHA512

6e2ce78583fecc79d9ada4b935aa0012683524bb81346412d0d72a726160714716c4160ed703ff02f56c94e327fab0bd255d1e6641f38f777440144ff9212d9f
SSDEEP

24576:DxAq+jNJvAraB438wJItC8mKnd6ecW+KAVMaTqVaZjYAFIsBlGuS1oOkWo1ukL9J:2NlbBHtTd6ecfBn2kpH/AM22s1TgB

Score

10^/10

amadey cryptbot lumma stealc 9c9aa5 stok discovery evasion persistence spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

https://shineugler.biz/api

https://tacitglibbr.biz/api

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	24d050288e.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	24d050288e.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	24d050288e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	24d050288e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 6 IoCs

pid	Process
2836	skotes.exe
1412	IQ7ux2z.exe
3852	sUSFJjY.exe
2300	cbab790ddd.exe
3100	a180fbea94.exe
3760	24d050288e.exe

Identifies Wine through registry keys 2 TTPs 3 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Software\Wine	24d050288e.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Power Settings 1 TTPs 4 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
6340	powercfg.exe
6732	powercfg.exe
6304	powercfg.exe
6264	powercfg.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0008000000023c60-20376.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
4236	file.exe
2836	skotes.exe
3760	24d050288e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	file.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4952	436	WerFault.exe	112

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IQ7ux2z.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbab790ddd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a180fbea94.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24d050288e.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
13444	powershell.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
6412	timeout.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
7316	taskkill.exe
6488	taskkill.exe
6772	taskkill.exe
5372	taskkill.exe
5824	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4236	file.exe
4236	file.exe
2836	skotes.exe
2836	skotes.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe
3760	24d050288e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1412	IQ7ux2z.exe
Token: SeDebugPrivilege	3852	sUSFJjY.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4236	file.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 2836	4236	file.exe	83
PID 4236 wrote to memory of 2836	4236	file.exe	83
PID 4236 wrote to memory of 2836	4236	file.exe	83
PID 2836 wrote to memory of 1412	2836	skotes.exe	84
PID 2836 wrote to memory of 1412	2836	skotes.exe	84
PID 2836 wrote to memory of 1412	2836	skotes.exe	84
PID 2836 wrote to memory of 3852	2836	skotes.exe	87
PID 2836 wrote to memory of 3852	2836	skotes.exe	87
PID 2836 wrote to memory of 2300	2836	skotes.exe	89
PID 2836 wrote to memory of 2300	2836	skotes.exe	89
PID 2836 wrote to memory of 2300	2836	skotes.exe	89
PID 2836 wrote to memory of 3100	2836	skotes.exe	91
PID 2836 wrote to memory of 3100	2836	skotes.exe	91
PID 2836 wrote to memory of 3100	2836	skotes.exe	91
PID 2836 wrote to memory of 3760	2836	skotes.exe	256
PID 2836 wrote to memory of 3760	2836	skotes.exe	256
PID 2836 wrote to memory of 3760	2836	skotes.exe	256
PID 2836 wrote to memory of 5956	2836	skotes.exe	96
PID 2836 wrote to memory of 5956	2836	skotes.exe	96
PID 2836 wrote to memory of 5956	2836	skotes.exe	96

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe
    "C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe
      "C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe"
      4⤵
      PID:9076
- - C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe
    "C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:3852
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANQA3ADgAMQAwADAAMQBcAHMAVQBTAEYASgBqAFkALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANQA3ADgAMQAwADAAMQBcAHMAVQBTAEYASgBqAFkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEkAcwBTAHQAbwBwAHAAZQBkAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEkAcwBTAHQAbwBwAHAAZQBkAC4AZQB4AGUA
      4⤵
      PID:4816
- - C:\Users\Admin\AppData\Local\Temp\1015909001\cbab790ddd.exe
    "C:\Users\Admin\AppData\Local\Temp\1015909001\cbab790ddd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2300
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      4⤵
      PID:5652
    - - C:\Windows\system32\mode.com
        
        mode 65,10
        5⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e file.zip -p24291711423417250691697322505 -oextracted
        5⤵
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_4.zip -oextracted
        5⤵
        
        PID:12356
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_3.zip -oextracted
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        
        7z.exe e extracted/file_1.zip -oextracted
        5⤵
        
        PID:12884
- - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
    "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3100
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3356
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3272
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2992
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2892
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4032
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6608
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:648
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3468
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:764
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1420
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:812
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4520
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4148
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1936
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:452
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7160
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5732
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6312
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:232
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1224
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7468
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6728
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5460
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6328
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7404
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7540
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7292
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5644
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4804
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1740
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7340
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7660
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6304
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4408
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:944
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3408
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8148
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2124
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6880
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1244
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5052
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2904
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6384
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7236
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:832
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7204
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7000
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6248
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6092
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5668
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7324
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6416
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4692
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6264
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7764
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2680
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6712
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:676
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4476
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2208
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:432
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8548
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8588
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:428
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9780
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4328
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10284
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10316
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10396
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10412
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10588
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10852
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10956
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10996
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11020
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:8076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5060
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6012
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:5000
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11384
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11468
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11540
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11612
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11668
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11740
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11748
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11780
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12188
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12196
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:2732
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12316
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12448
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12744
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12912
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12960
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13104
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13168
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13200
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13216
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12784
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13356
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13540
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13588
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13612
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13668
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13724
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14052
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14572
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15044
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15084
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15092
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15156
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15196
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15228
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15468
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15492
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15732
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15932
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15972
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16140
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16204
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16432
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16504
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16520
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16576
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16656
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16888
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16960
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17016
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17096
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17112
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17320
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17352
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17368
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17400
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17424
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17480
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17488
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17496
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17512
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17528
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17536
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17544
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17568
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17576
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17592
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17608
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17632
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17648
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17696
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17704
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17800
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17808
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17824
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17872
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17928
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17980
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:17988
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18020
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18036
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18060
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18100
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18116
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18148
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18156
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18196
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18228
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18236
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18260
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18292
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18308
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18316
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18364
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18404
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18448
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18472
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18480
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18496
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18504
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18536
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18544
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18552
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18560
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18568
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18592
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18600
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18616
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18632
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18672
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18680
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18736
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18744
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18752
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18768
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18776
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18784
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18792
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18800
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18808
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18816
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18824
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18832
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18840
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18848
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18856
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18904
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18912
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18936
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18960
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18968
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:18984
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19016
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19024
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19032
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19040
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19064
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19104
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19112
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19120
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19136
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19152
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19160
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19176
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19184
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19224
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19232
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19240
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19256
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19272
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19280
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19288
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19296
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19304
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19312
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19336
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19368
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19384
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19400
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19416
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19424
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19440
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19448
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19460
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19484
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19508
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19516
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19548
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19556
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19564
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19572
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19596
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19604
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19620
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19636
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19644
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19660
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19708
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19724
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19740
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19748
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19764
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19772
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19780
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19796
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19812
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19828
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19852
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19860
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19876
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19940
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19956
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19972
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:19996
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20004
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20028
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20052
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20068
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20076
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20084
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20092
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20116
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20132
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20148
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20156
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20172
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20180
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20188
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20204
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20212
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20220
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20228
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20236
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20244
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20252
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20268
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20276
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20284
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20292
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20300
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20308
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20332
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20340
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20348
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20364
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20372
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20396
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20404
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20412
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20444
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20452
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20460
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20496
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20528
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20536
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20592
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20608
  - - C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe
      "C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe"
      4⤵
      PID:20632
- - C:\Users\Admin\AppData\Local\Temp\1015911001\24d050288e.exe
    "C:\Users\Admin\AppData\Local\Temp\1015911001\24d050288e.exe"
    3⤵
    - Enumerates VirtualBox registry keys
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3760
- - C:\Users\Admin\AppData\Local\Temp\1015912001\28e54a293b.exe
    "C:\Users\Admin\AppData\Local\Temp\1015912001\28e54a293b.exe"
    3⤵
    PID:5956
- - C:\Users\Admin\AppData\Local\Temp\1015913001\dbbf4525cd.exe
    "C:\Users\Admin\AppData\Local\Temp\1015913001\dbbf4525cd.exe"
    3⤵
    PID:436
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1015913001\dbbf4525cd.exe" & rd /s /q "C:\ProgramData\00HVS2NY5XBA" & exit
      4⤵
      PID:7672
    - - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        5⤵
        Delays execution with timeout.exe
        
        PID:6412
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 436 -s 1708
      4⤵
      Program crash
      PID:4952
- - C:\Users\Admin\AppData\Local\Temp\1015914001\3573ea7222.exe
    "C:\Users\Admin\AppData\Local\Temp\1015914001\3573ea7222.exe"
    3⤵
    PID:7032
- - C:\Users\Admin\AppData\Local\Temp\1015915001\28053d6e22.exe
    "C:\Users\Admin\AppData\Local\Temp\1015915001\28053d6e22.exe"
    3⤵
    PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\J9UDBX2ZGIXK72NDFCL5K37DV5J.exe
      "C:\Users\Admin\AppData\Local\Temp\J9UDBX2ZGIXK72NDFCL5K37DV5J.exe"
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Local\Temp\FOAEXELETR0VWL3GVS2I7.exe
      "C:\Users\Admin\AppData\Local\Temp\FOAEXELETR0VWL3GVS2I7.exe"
      4⤵
      PID:1572
- - C:\Users\Admin\AppData\Local\Temp\1015916001\c7c1b07e3e.exe
    "C:\Users\Admin\AppData\Local\Temp\1015916001\c7c1b07e3e.exe"
    3⤵
    PID:5484
- - C:\Users\Admin\AppData\Local\Temp\1015917001\eb82f885ed.exe
    "C:\Users\Admin\AppData\Local\Temp\1015917001\eb82f885ed.exe"
    3⤵
    PID:6160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM firefox.exe /T
      4⤵
      Kills process with taskkill
      PID:7316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM chrome.exe /T
      4⤵
      Kills process with taskkill
      PID:6488
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM msedge.exe /T
      4⤵
      Kills process with taskkill
      PID:6772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM opera.exe /T
      4⤵
      Kills process with taskkill
      PID:5372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /F /IM brave.exe /T
      4⤵
      Kills process with taskkill
      PID:5824
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
      4⤵
      PID:5224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
        5⤵
        
        PID:1364
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1944 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97df195b-5c66-4457-abb3-80c95180b2ff} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" gpu
        6⤵
        
        PID:3460
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2424 -parentBuildID 20240401114208 -prefsHandle 2408 -prefMapHandle 2404 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {715f8db0-715d-417f-86f1-618a0ad4527c} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" socket
        6⤵
        
        PID:1972
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3200 -childID 1 -isForBrowser -prefsHandle 3196 -prefMapHandle 3192 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c0058d9-7a78-4065-8075-631dfd87dab4} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
        6⤵
        
        PID:1988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4392 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4508 -prefMapHandle 4384 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cbde908b-fa8f-4705-93f9-23912d116bc8} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" utility
        6⤵
        
        PID:8988
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5620 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5692 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 892 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {655f8f1c-91e7-44b8-9ea4-d58d40451819} 1364 "\\.\pipe\gecko-crash-server-pipe.1364" tab
        6⤵
        
        PID:8808
- - C:\Users\Admin\AppData\Local\Temp\1015918001\461f93fb71.exe
    "C:\Users\Admin\AppData\Local\Temp\1015918001\461f93fb71.exe"
    3⤵
    PID:4500

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
1⤵
PID:5844
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  PID:6264
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  PID:6304
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  PID:6732
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  PID:6340
- C:\Windows\explorer.exe
  explorer.exe
  2⤵
  PID:6988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 436 -ip 436
1⤵
PID:6248

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell ping 127.0.0.1; del in.exe
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
PID:13444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Power Settings

T1653

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1015665001\IQ7ux2z.exe

Filesize
2.8MB

MD5
0dad190f420a0a09ed8c262ca18b1097

SHA1
b97535bf2960278b19bda8cad9e885b8eefbdc85

SHA256
29e1e95110c03e84720e213a2bb0dcdff95af85a8a894d71518e06c62131e64a

SHA512
8ae92676fc5539899414f0a70cba1ed01685b30af9002c68114720d6a7213e4e9c2368e17717c4e3e02650781a022001e4a2e43f83afbd709e7f1ab81003b646

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015781001\sUSFJjY.exe

Filesize
87KB

MD5
3c104350cc2661c345673e91ed672c4c

SHA1
d205e94d47949cf3bc3f5226978f6d370c3d3b94

SHA256
1fb9f279263c252a09f12b69c7238c18d2325f7cf7250ebe24ad9149abe62cf4

SHA512
9c02bde2d096e181f00e906f4e242905d0e54dd207f309764805c7444c9f43073106812ade97fca9fc2363f59ed071371276880ce85e9a307fcdb03d3250cf6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015909001\cbab790ddd.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015910001\a180fbea94.exe

Filesize
710KB

MD5
28e568616a7b792cac1726deb77d9039

SHA1
39890a418fb391b823ed5084533e2e24dff021e1

SHA256
9597798f7789adc29fbe97707b1bd8ca913c4d5861b0ad4fdd6b913af7c7a8e2

SHA512
85048799e6d2756f1d6af77f34e6a1f454c48f2f43042927845931b7ecff2e5de45f864627a3d4aa061252401225bbb6c2caa8532320ccbe401e97c9c79ac8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015911001\24d050288e.exe

Filesize
4.3MB

MD5
2c719f77b7093d405c076ea8e1cecb89

SHA1
ff8da0285514de691aa3b14f51b0224a9363054f

SHA256
d1f1891332480d2aebf175fb230eb818fc1de151f8cb6e860b9822351fdc9b0b

SHA512
2da4a1060b0d7242cd5cc673aee55502e2424a657d68d0971ceb5be2d496cb4c817ccd00800bc66ea37c9df6f587f211f1dbef3d6487d20e53bdeaf782f261a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015912001\28e54a293b.exe

Filesize
4.2MB

MD5
9cd3dd1f0ba9ae14948c09641964263e

SHA1
2d8ea117b20a8d0c24d5c30458a5a48006820f26

SHA256
47ab6ccb1016d2f68e31982f6d26a3309b69f46ba3bd33e7b5c2ec80ba1b92a7

SHA512
e47c9639fb4178e7146b2c8242a0e710d245bfa594656380b5b0200b1072bd6342e419ff788fcb65296b475c4b7d8a5f3cf30837a6b948032009ac1c72052590

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015913001\dbbf4525cd.exe

Filesize
384KB

MD5
dfd5f78a711fa92337010ecc028470b4

SHA1
1a389091178f2be8ce486cd860de16263f8e902e

SHA256
da96f2eb74e60de791961ef3800c36a5e12202fe97ae5d2fcfc1fe404bc13c0d

SHA512
a3673074919039a2dc854b0f91d1e1a69724056594e33559741f53594e0f6e61e3d99ec664d541b17f09ffdebc2de1b042eec19ca8477fac86359c703f8c9656

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015914001\3573ea7222.exe

Filesize
1.7MB

MD5
6c1d0dabe1ec5e928f27b3223f25c26b

SHA1
e25ab704a6e9b3e4c30a6c1f7043598a13856ad9

SHA256
92228a0012605351cf08df9a2ad4b93fa552d7a75991f81fb80f1ae854a0e57d

SHA512
3a3f7af4f6018fcbd8c6f2871270504731cf269134453c9a146351c3e4a5c89165ecccafb3655d8b39c1ff1ec68f06e1851c0abd66d47602e1f0f8e36d4acfe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015915001\28053d6e22.exe

Filesize
1.8MB

MD5
3d4a94c3e222201f148286f01b28f039

SHA1
ea41f2294518af19480a7ca04dd23b69db9168c4

SHA256
0b962aa320e1c5c173e5548343d0b490700f9e63e1d00d232e752750bcc0fc5a

SHA512
3a8706e2d67700e93410cc256ffd5ccb1b11937e6d33f6932ab72e2e8e464ebaf98c27d5a885d327e9cdd0b04eef2a844f3959660febc8cfe10c31e7a6b4b246

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015916001\c7c1b07e3e.exe

Filesize
1.7MB

MD5
c4ad0585ec13501c826c13da4cc8259c

SHA1
c7f86a08ff8ce20cee6c68abc56d1f19da4a869f

SHA256
13ca86c3120bbb8dd9ca84968ed6f3d1ecd5353fa169f30a9f93b2128236b7b1

SHA512
b18d17c6a4f984b9fb6c59c27ae9c5fc0c999dad98ac851ee43f5ab6900bb73b6b19ed1519cd14754c2998cce052e2eea2bee32b5d45ab423b082ca0cc7b2a6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015917001\eb82f885ed.exe

Filesize
950KB

MD5
6cd06c3c3ce4c1c6eb761a77da276278

SHA1
f21778e5e8b671c920b92faaf0fce9dfadd7ea08

SHA256
76229e74a6b4f0a2b3eb2cb946b81ee138106bb63ad40cd5685c628ffe7a40bb

SHA512
7904e34c85ce13b79e52ea090fca9630a76a148c22510dc632408431993bacd099aef894e71d4bd1eeadc4789bf8ac94169dc8871a866540ee01b0234f826d86

Download Submit
C:\Users\Admin\AppData\Local\Temp\1015918001\461f93fb71.exe

Filesize
2.7MB

MD5
cc25965e207fc5c50a5bcc758271d56f

SHA1
5d59e2e71cbaad634096b78c055abd4d58aeaa34

SHA256
adf0e83167a7e60e826e8de255e0201c71b335e64c9a9a15c6bf1550b14f7a4a

SHA512
7cfaf96e00910139ccd5c400b73204e16870b81f3070cc1689937b0efdb9b0a42c88148104ca99c74048294f1cacd5e5bab57d5d0d4e309e08f4cdb1fd26d7af

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2utwkxwf.srg.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.8MB

MD5
5bf4d30eee7b7951072135193f435f40

SHA1
b0b712d7020ded9b13601c808d8e32a8a0a3cc3e

SHA256
4832db62e582a4f94a082189971f43e6570517486ea799a7661f795257e920cf

SHA512
6e2ce78583fecc79d9ada4b935aa0012683524bb81346412d0d72a726160714716c4160ed703ff02f56c94e327fab0bd255d1e6641f38f777440144ff9212d9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
1.3MB

MD5
d83007e1611e0ceddc33b401df2b568a

SHA1
26df79a718f27bda3e1811b3de021f2fdecdfdd3

SHA256
b0f9d00e142bd403d8ab84632fdba0f0abe2c7aafdee18b1be30d2ca729c4d5f

SHA512
b12e21f0c1ef5d3562b4b6d50f0b82dae688e3a7c5156015e24f7e7cfb89e8130affe6bfd2aaa2e6b0d8408ba693f344247c968e6ac368d1c1e554fbe83a500d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
14da1d8e8b8a02c7298bd210532cbbdd

SHA1
7582b16694348cf771dbeaf56c5f07a0849f8dd5

SHA256
68e17cead191094c05ad4ca60736a396027b5973452a67acf9d0773b66b9cbf7

SHA512
8105d0e1ab8daa93e0faa2b1a3dc78b99a3676993ed043c9d32281aa2f6edd1fc41725db6cd422369c8fe86739b2c4b7fd2492a7c04608e7def09e5f6302aeec

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\datareporting\glean\pending_pings\f4a44f54-293e-433d-a920-faf09895b2ec

Filesize
25KB

MD5
8ee051fdb40859e3386d53492fc1d611

SHA1
a795310a5e1bec61bdfce61bbe8400e441cf788e

SHA256
ef300b123087696f1532c0116ba3a9a8086a6f552a3d1cdb7ab2d6c329722241

SHA512
a0f84d98494829ffc64746e5cba867479c6cc61d5047b111849306419e77a2cd046f30603f1860c6066a41c428751d59cf7cd0a523fe87bad24939fd11ff187a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
10KB

MD5
140ea9df4aed6f513f08902cd5889625

SHA1
7be2e04853453f271a8c5f11e2124deb4a3d4d03

SHA256
daba68aeed300860e71ff1e8ed2c9e28344a1d858707e3a77bf1122cbedbdd19

SHA512
305e58bdd62f693f39b927fadb9de7e15254b590c1163355c67e1a005ed5c42a5643864a868d5d7ab76c36d36b80d8143e76ffeaf4f9773818cca61cc7ac3919

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\iz0mcgq4.default-release\prefs-1.js

Filesize
12KB

MD5
0a7c4a385e3eb96d1332973d6f737a74

SHA1
f783a90b9dff602e25055be1489a0851e1a669d1

SHA256
3eefc6db1146eb2c79bab97ebbca7bfb14a31059968ff46540841b5186563065

SHA512
49d9dcfd83f4407c4cdfd046d9b14ae71b7ebb76c7d630ee26ac78a64e2a9aa1af8c6fa274db5a5e6faf65beb7476725b992fa7e844e01e626db0f144692d35a

Download Submit
memory/1412-105-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-50-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-99-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-101-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-97-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-95-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-93-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-89-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-87-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-86-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-83-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-81-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-77-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-75-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-73-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-71-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-70-0x00000000738A0000-0x0000000074050000-memory.dmp

Filesize
7.7MB

Download
memory/1412-68-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-66-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-64-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-60-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-58-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-57-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-54-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-52-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-42-0x0000000000B40000-0x0000000000E1C000-memory.dmp

Filesize
2.9MB

Download
memory/1412-48-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-47-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-103-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-109-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-107-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-43-0x00000000738AE000-0x00000000738AF000-memory.dmp

Filesize
4KB

Download
memory/1412-79-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-30694-0x00000000738A0000-0x0000000074050000-memory.dmp

Filesize
7.7MB

Download
memory/1412-62-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-3028-0x00000000738A0000-0x0000000074050000-memory.dmp

Filesize
7.7MB

Download
memory/1412-3026-0x00000000738AE000-0x00000000738AF000-memory.dmp

Filesize
4KB

Download
memory/1412-44-0x0000000005980000-0x0000000005B3E000-memory.dmp

Filesize
1.7MB

Download
memory/1412-91-0x0000000005980000-0x0000000005B38000-memory.dmp

Filesize
1.7MB

Download
memory/1412-45-0x00000000738A0000-0x0000000074050000-memory.dmp

Filesize
7.7MB

Download
memory/1572-30484-0x0000000000110000-0x00000000007A6000-memory.dmp

Filesize
6.6MB

Download
memory/1980-30478-0x0000000000D40000-0x0000000001004000-memory.dmp

Filesize
2.8MB

Download
memory/1980-30479-0x0000000000D40000-0x0000000001004000-memory.dmp

Filesize
2.8MB

Download
memory/1980-30477-0x0000000000D40000-0x0000000001004000-memory.dmp

Filesize
2.8MB

Download
memory/2836-46-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/2836-20-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/2836-17-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/2836-41-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/2836-19-0x0000000000FC1000-0x0000000000FEF000-memory.dmp

Filesize
184KB

Download
memory/2836-21-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/2836-22-0x0000000000FC0000-0x00000000012D2000-memory.dmp

Filesize
3.1MB

Download
memory/3760-8416-0x0000000001000000-0x0000000001BF6000-memory.dmp

Filesize
12.0MB

Download
memory/3760-15080-0x0000000001000000-0x0000000001BF6000-memory.dmp

Filesize
12.0MB

Download
memory/3760-12454-0x0000000001000000-0x0000000001BF6000-memory.dmp

Filesize
12.0MB

Download
memory/3852-627-0x000002A575F50000-0x000002A575F56000-memory.dmp

Filesize
24KB

Download
memory/3852-13312-0x000002A57A130000-0x000002A57A184000-memory.dmp

Filesize
336KB

Download
memory/3852-585-0x000002A575B80000-0x000002A575B98000-memory.dmp

Filesize
96KB

Download
memory/3852-3819-0x000002A578250000-0x000002A5787BE000-memory.dmp

Filesize
5.4MB

Download
memory/3852-8720-0x000002A5787C0000-0x000002A578C9E000-memory.dmp

Filesize
4.9MB

Download
memory/3852-8721-0x000002A578CA0000-0x000002A578CEC000-memory.dmp

Filesize
304KB

Download
memory/4236-0-0x0000000000450000-0x0000000000762000-memory.dmp

Filesize
3.1MB

Download
memory/4236-2-0x0000000000451000-0x000000000047F000-memory.dmp

Filesize
184KB

Download
memory/4236-1-0x0000000077C94000-0x0000000077C96000-memory.dmp

Filesize
8KB

Download
memory/4236-16-0x0000000000450000-0x0000000000762000-memory.dmp

Filesize
3.1MB

Download
memory/4236-3-0x0000000000450000-0x0000000000762000-memory.dmp

Filesize
3.1MB

Download
memory/4236-4-0x0000000000450000-0x0000000000762000-memory.dmp

Filesize
3.1MB

Download
memory/4500-23222-0x0000000000160000-0x0000000000424000-memory.dmp

Filesize
2.8MB

Download
memory/4500-27262-0x0000000000160000-0x0000000000424000-memory.dmp

Filesize
2.8MB

Download
memory/4500-29136-0x0000000000160000-0x0000000000424000-memory.dmp

Filesize
2.8MB

Download
memory/4500-24579-0x0000000000160000-0x0000000000424000-memory.dmp

Filesize
2.8MB

Download
memory/4500-24578-0x0000000000160000-0x0000000000424000-memory.dmp

Filesize
2.8MB

Download
memory/4816-16415-0x000001D67A6B0000-0x000001D67A6D2000-memory.dmp

Filesize
136KB

Download
memory/5484-21830-0x0000000000E70000-0x0000000001506000-memory.dmp

Filesize
6.6MB

Download
memory/5484-19033-0x0000000000E70000-0x0000000001506000-memory.dmp

Filesize
6.6MB

Download
memory/5956-11276-0x0000000000A00000-0x000000000162E000-memory.dmp

Filesize
12.2MB

Download
memory/5956-12354-0x0000000000A00000-0x000000000162E000-memory.dmp

Filesize
12.2MB

Download
memory/6364-30483-0x0000000000FD0000-0x000000000147C000-memory.dmp

Filesize
4.7MB

Download
memory/6364-20885-0x0000000000FD0000-0x000000000147C000-memory.dmp

Filesize
4.7MB

Download
memory/6364-17145-0x0000000000FD0000-0x000000000147C000-memory.dmp

Filesize
4.7MB

Download
memory/7032-15240-0x00000000001A0000-0x000000000062B000-memory.dmp

Filesize
4.5MB

Download
memory/7032-30471-0x00000000001A0000-0x000000000062B000-memory.dmp

Filesize
4.5MB

Download
memory/7032-18707-0x00000000001A0000-0x000000000062B000-memory.dmp

Filesize
4.5MB

Download
memory/9076-30861-0x0000000005ED0000-0x0000000005F36000-memory.dmp

Filesize
408KB

Download
memory/9076-30692-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download