amadey | 14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

Analysis

max time kernel
141s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-12-2024 14:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Size

2.9MB
MD5

842e251ca1e3a812356248ebe8154f16
SHA1

efb511d328cf0a7690e62cbb89adeebc07dddb3c
SHA256

14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a
SHA512

2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74
SSDEEP

49152:FfD0T39ZF8R21uPbS2fH/F9xcThPDf0x:FfD0TfFsquPbSQH/FncZI

Score

10^/10

amadey cryptbot xmrig 9c9aa5 discovery evasion miner spyware stealer trojan upx

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 43108 created 2652	43108	Process not Found	44

Xmrig family
xmrig
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Process not Found

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral2/memory/197804-250-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-251-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-255-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-257-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-258-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-253-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-249-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-248-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-247-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/197804-246-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/320092-291-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/320092-293-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig
behavioral2/memory/320092-296-0x0000000140000000-0x0000000140770000-memory.dmp	xmrig

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 16 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	Process not Found
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe

Executes dropped EXE 64 IoCs

pid	Process
3896	skotes.exe
1004	acd382f2bc.exe
3712	skotes.exe
4472	acd382f2bc.exe
4000	acd382f2bc.exe
4724	acd382f2bc.exe
4444	acd382f2bc.exe
1680	acd382f2bc.exe
516	acd382f2bc.exe
3792	acd382f2bc.exe
464	acd382f2bc.exe
3860	acd382f2bc.exe
1984	acd382f2bc.exe
4036	acd382f2bc.exe
2428	acd382f2bc.exe
3612	acd382f2bc.exe
4892	acd382f2bc.exe
4260	acd382f2bc.exe
212	acd382f2bc.exe
184	acd382f2bc.exe
2760	acd382f2bc.exe
1684	acd382f2bc.exe
3292	acd382f2bc.exe
3616	acd382f2bc.exe
1660	acd382f2bc.exe
4268	acd382f2bc.exe
1584	acd382f2bc.exe
1588	acd382f2bc.exe
536	acd382f2bc.exe
1732	acd382f2bc.exe
3632	acd382f2bc.exe
3128	acd382f2bc.exe
4604	acd382f2bc.exe
1072	acd382f2bc.exe
2432	acd382f2bc.exe
4860	acd382f2bc.exe
3940	acd382f2bc.exe
2196	acd382f2bc.exe
2628	acd382f2bc.exe
2820	acd382f2bc.exe
2936	acd382f2bc.exe
4620	acd382f2bc.exe
720	acd382f2bc.exe
3608	acd382f2bc.exe
1972	acd382f2bc.exe
2340	acd382f2bc.exe
3768	acd382f2bc.exe
1648	acd382f2bc.exe
5100	acd382f2bc.exe
4076	acd382f2bc.exe
2756	acd382f2bc.exe
5008	acd382f2bc.exe
4164	acd382f2bc.exe
3264	acd382f2bc.exe
4948	acd382f2bc.exe
1832	acd382f2bc.exe
3308	acd382f2bc.exe
3692	acd382f2bc.exe
3924	acd382f2bc.exe
2940	acd382f2bc.exe
1908	acd382f2bc.exe
3744	acd382f2bc.exe
4508	acd382f2bc.exe
1636	acd382f2bc.exe

Identifies Wine through registry keys 2 TTPs 8 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	Process not Found

Loads dropped DLL 8 IoCs

pid	Process
63432	Process not Found
63776	Process not Found
64076	Process not Found
64328	Process not Found
64476	Process not Found
64608	Process not Found
64796	Process not Found
64952	Process not Found

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
3896	skotes.exe
3712	skotes.exe
22424	Process not Found
35720	Process not Found
43108	Process not Found
194628	Process not Found
319952	Process not Found

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 197560 set thread context of 197804	197560	Process not Found	26796
PID 320076 set thread context of 320092	320076	Process not Found	39497

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/65476-224-0x00007FF6ACB90000-0x00007FF6AD020000-memory.dmp	upx
behavioral2/memory/65476-221-0x00007FF6ACB90000-0x00007FF6AD020000-memory.dmp	upx
behavioral2/memory/197560-244-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp	upx
behavioral2/memory/197560-259-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp	upx
behavioral2/memory/320076-279-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp	upx
behavioral2/memory/320076-295-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp	upx

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
50208	43108	Process not Found	4975

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	acd382f2bc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
64840	Process not Found
67384	Process not Found
212424	Process not Found
219912	Process not Found
320148	Process not Found
320328	Process not Found

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
67384	Process not Found
219912	Process not Found
320328	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
64804	Process not Found

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
3896	skotes.exe
3896	skotes.exe
3712	skotes.exe
3712	skotes.exe
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
22424	Process not Found
35720	Process not Found
35720	Process not Found
43108	Process not Found
43108	Process not Found
43108	Process not Found
43108	Process not Found
43108	Process not Found
43108	Process not Found
48468	Process not Found
48468	Process not Found
48468	Process not Found
48468	Process not Found
64840	Process not Found
64840	Process not Found
64840	Process not Found
194628	Process not Found
194628	Process not Found
197560	Process not Found
212424	Process not Found
212424	Process not Found
319952	Process not Found
319952	Process not Found
320076	Process not Found
320148	Process not Found
320148	Process not Found

Suspicious use of AdjustPrivilegeToken 37 IoCs

description	pid	Process
Token: SeRestorePrivilege	63432	Process not Found
Token: 35	63432	Process not Found
Token: SeSecurityPrivilege	63432	Process not Found
Token: SeSecurityPrivilege	63432	Process not Found
Token: SeRestorePrivilege	63776	Process not Found
Token: 35	63776	Process not Found
Token: SeSecurityPrivilege	63776	Process not Found
Token: SeSecurityPrivilege	63776	Process not Found
Token: SeRestorePrivilege	64076	Process not Found
Token: 35	64076	Process not Found
Token: SeSecurityPrivilege	64076	Process not Found
Token: SeSecurityPrivilege	64076	Process not Found
Token: SeRestorePrivilege	64328	Process not Found
Token: 35	64328	Process not Found
Token: SeSecurityPrivilege	64328	Process not Found
Token: SeSecurityPrivilege	64328	Process not Found
Token: SeRestorePrivilege	64476	Process not Found
Token: 35	64476	Process not Found
Token: SeSecurityPrivilege	64476	Process not Found
Token: SeSecurityPrivilege	64476	Process not Found
Token: SeRestorePrivilege	64608	Process not Found
Token: 35	64608	Process not Found
Token: SeSecurityPrivilege	64608	Process not Found
Token: SeSecurityPrivilege	64608	Process not Found
Token: SeRestorePrivilege	64796	Process not Found
Token: 35	64796	Process not Found
Token: SeSecurityPrivilege	64796	Process not Found
Token: SeSecurityPrivilege	64796	Process not Found
Token: SeRestorePrivilege	64952	Process not Found
Token: 35	64952	Process not Found
Token: SeSecurityPrivilege	64952	Process not Found
Token: SeSecurityPrivilege	64952	Process not Found
Token: SeDebugPrivilege	64840	Process not Found
Token: SeLockMemoryPrivilege	197804	Process not Found
Token: SeDebugPrivilege	212424	Process not Found
Token: SeLockMemoryPrivilege	320092	Process not Found
Token: SeDebugPrivilege	320148	Process not Found

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 812 wrote to memory of 3896	812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe	84
PID 812 wrote to memory of 3896	812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe	84
PID 812 wrote to memory of 3896	812	14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe	84
PID 3896 wrote to memory of 1004	3896	skotes.exe	86
PID 3896 wrote to memory of 1004	3896	skotes.exe	86
PID 3896 wrote to memory of 1004	3896	skotes.exe	86
PID 1004 wrote to memory of 4472	1004	acd382f2bc.exe	89
PID 1004 wrote to memory of 4472	1004	acd382f2bc.exe	89
PID 1004 wrote to memory of 4472	1004	acd382f2bc.exe	89
PID 1004 wrote to memory of 4000	1004	acd382f2bc.exe	90
PID 1004 wrote to memory of 4000	1004	acd382f2bc.exe	90
PID 1004 wrote to memory of 4000	1004	acd382f2bc.exe	90
PID 1004 wrote to memory of 4444	1004	acd382f2bc.exe	91
PID 1004 wrote to memory of 4444	1004	acd382f2bc.exe	91
PID 1004 wrote to memory of 4444	1004	acd382f2bc.exe	91
PID 1004 wrote to memory of 4724	1004	acd382f2bc.exe	92
PID 1004 wrote to memory of 4724	1004	acd382f2bc.exe	92
PID 1004 wrote to memory of 4724	1004	acd382f2bc.exe	92
PID 1004 wrote to memory of 1680	1004	acd382f2bc.exe	93
PID 1004 wrote to memory of 1680	1004	acd382f2bc.exe	93
PID 1004 wrote to memory of 1680	1004	acd382f2bc.exe	93
PID 1004 wrote to memory of 516	1004	acd382f2bc.exe	94
PID 1004 wrote to memory of 516	1004	acd382f2bc.exe	94
PID 1004 wrote to memory of 516	1004	acd382f2bc.exe	94
PID 1004 wrote to memory of 3792	1004	acd382f2bc.exe	95
PID 1004 wrote to memory of 3792	1004	acd382f2bc.exe	95
PID 1004 wrote to memory of 3792	1004	acd382f2bc.exe	95
PID 1004 wrote to memory of 464	1004	acd382f2bc.exe	96
PID 1004 wrote to memory of 464	1004	acd382f2bc.exe	96
PID 1004 wrote to memory of 464	1004	acd382f2bc.exe	96
PID 1004 wrote to memory of 3860	1004	acd382f2bc.exe	97
PID 1004 wrote to memory of 3860	1004	acd382f2bc.exe	97
PID 1004 wrote to memory of 3860	1004	acd382f2bc.exe	97
PID 1004 wrote to memory of 1984	1004	acd382f2bc.exe	98
PID 1004 wrote to memory of 1984	1004	acd382f2bc.exe	98
PID 1004 wrote to memory of 1984	1004	acd382f2bc.exe	98
PID 1004 wrote to memory of 4036	1004	acd382f2bc.exe	99
PID 1004 wrote to memory of 4036	1004	acd382f2bc.exe	99
PID 1004 wrote to memory of 4036	1004	acd382f2bc.exe	99
PID 1004 wrote to memory of 2428	1004	acd382f2bc.exe	100
PID 1004 wrote to memory of 2428	1004	acd382f2bc.exe	100
PID 1004 wrote to memory of 2428	1004	acd382f2bc.exe	100
PID 1004 wrote to memory of 3612	1004	acd382f2bc.exe	101
PID 1004 wrote to memory of 3612	1004	acd382f2bc.exe	101
PID 1004 wrote to memory of 3612	1004	acd382f2bc.exe	101
PID 1004 wrote to memory of 4892	1004	acd382f2bc.exe	102
PID 1004 wrote to memory of 4892	1004	acd382f2bc.exe	102
PID 1004 wrote to memory of 4892	1004	acd382f2bc.exe	102
PID 1004 wrote to memory of 4260	1004	acd382f2bc.exe	103
PID 1004 wrote to memory of 4260	1004	acd382f2bc.exe	103
PID 1004 wrote to memory of 4260	1004	acd382f2bc.exe	103
PID 1004 wrote to memory of 212	1004	acd382f2bc.exe	104
PID 1004 wrote to memory of 212	1004	acd382f2bc.exe	104
PID 1004 wrote to memory of 212	1004	acd382f2bc.exe	104
PID 1004 wrote to memory of 184	1004	acd382f2bc.exe	105
PID 1004 wrote to memory of 184	1004	acd382f2bc.exe	105
PID 1004 wrote to memory of 184	1004	acd382f2bc.exe	105
PID 1004 wrote to memory of 2760	1004	acd382f2bc.exe	106
PID 1004 wrote to memory of 2760	1004	acd382f2bc.exe	106
PID 1004 wrote to memory of 2760	1004	acd382f2bc.exe	106
PID 1004 wrote to memory of 1684	1004	acd382f2bc.exe	107
PID 1004 wrote to memory of 1684	1004	acd382f2bc.exe	107
PID 1004 wrote to memory of 1684	1004	acd382f2bc.exe	107
PID 1004 wrote to memory of 3292	1004	acd382f2bc.exe	108

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
65372	Process not Found
64740	Process not Found
64624	Process not Found

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2652

C:\Users\Admin\AppData\Local\Temp\14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe
"C:\Users\Admin\AppData\Local\Temp\14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:812
- C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
  "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
    "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1004
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:516
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2428
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4892
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:212
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1588
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2628
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2820
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2340
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:5100
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3692
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3924
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:2940
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      Executes dropped EXE
      PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2580
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2300
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3140
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1028
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2972
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:548
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:404
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4156
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:900
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:812
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2516
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:628
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:868
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:748
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:1464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:884
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5168
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6096
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6172
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6188
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6236
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6244
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6252
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6276
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6284
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6308
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6332
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6340
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6452
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6484
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6492
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6532
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6572
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6580
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6588
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6620
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6628
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6636
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6668
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6692
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6724
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6748
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6788
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6804
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6852
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6900
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6908
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6940
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6980
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:6996
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7004
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7052
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7060
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7068
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8096
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8120
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8240
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9120
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9152
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9160
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:2944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10144
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10160
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10216
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:10992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11104
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11120
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11144
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11152
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11160
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11168
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11192
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11216
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11224
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11240
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:5108
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11272
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11312
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11320
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11352
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11360
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11376
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11384
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11392
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11408
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11416
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11424
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11432
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11448
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11456
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11464
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11472
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11480
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11488
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11512
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11568
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11608
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11616
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11624
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11640
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11656
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11672
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11688
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11696
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11776
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11784
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11800
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11816
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11824
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11888
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11912
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11944
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11952
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11976
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12024
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12032
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12040
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12048
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12088
  - - C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe
      "C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe"
      4⤵
      PID:12096

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:3712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\1016661001\acd382f2bc.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016662001\d6b4ed56e2.exe

Filesize
4.2MB

MD5
022d6400fce5286db976b004d2e6ca6d

SHA1
a5b6aa5e1d75d36eb9f319a4a37988bbcd565ec3

SHA256
b02634b17908d8ee52c2d11a50572b7227b2510a6c25ab3847b979808b0aa50c

SHA512
610de3e59c987288f504a3e6061be5cfa6b257882d3113b1c244275d5f1c38cc1e3b5383e1e473813ccb0e95737177b894b616ec416fcb014b5f0f0083a69b6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016663001\1e6a884daf.exe

Filesize
4.3MB

MD5
eac15673f4e20ec549adb1e79166124a

SHA1
b5e8a8768f90ff2e19031008b36309d4ba207a3c

SHA256
04bd9f0802c45b8affa1969006e78af4e12e991cc7e683df10bd370b5979e134

SHA512
8e7666be51e08f33fd787cbf34cedfa402250abf50f527d81ec2a8df1084b36822c24e10ed1c16e6ee4c4b29ff947dfa21eb7c85d36953140cb62c156ab40d56

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016664001\458f0a29f9.exe

Filesize
1.9MB

MD5
8317f4066452222fae09837c5df94ed2

SHA1
af3dae4376723dea094f0caba585af5df3b24269

SHA256
b363421afbee72e899d54508026f0c766bd04333ec087c8c96614c9bc735be56

SHA512
8a26b6c4ec847733786efb5157358d3353e917b046be39d44ae9635ba31e98e7b0fc454aaf9d7b07b6648c5364218a749b4652ac941b813475f01bac6a3f2f8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1016665001\d12b72541e.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_kjonagdi.33j.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
842e251ca1e3a812356248ebe8154f16

SHA1
efb511d328cf0a7690e62cbb89adeebc07dddb3c

SHA256
14caca276f869dcc33a065b67a826a79c27cb0ec54407da220ed26cd045d941a

SHA512
2eaf72c87cda80fcc64463eda29ad62e21818bac52105af0b95c5504c935e7f480cba518575fad8f80d0748e11e41641063cb8b6e61da8584271e1068d7f3b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
memory/812-4-0x0000000000E50000-0x000000000116B000-memory.dmp

Filesize
3.1MB

Download
memory/812-17-0x0000000000E50000-0x000000000116B000-memory.dmp

Filesize
3.1MB

Download
memory/812-0-0x0000000000E50000-0x000000000116B000-memory.dmp

Filesize
3.1MB

Download
memory/812-3-0x0000000000E50000-0x000000000116B000-memory.dmp

Filesize
3.1MB

Download
memory/812-2-0x0000000000E51000-0x0000000000E7F000-memory.dmp

Filesize
184KB

Download
memory/812-1-0x0000000076F04000-0x0000000076F06000-memory.dmp

Filesize
8KB

Download
memory/1004-39-0x0000000000365000-0x0000000000366000-memory.dmp

Filesize
4KB

Download
memory/1004-132-0x0000000000365000-0x0000000000366000-memory.dmp

Filesize
4KB

Download
memory/3712-38-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3712-100-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-19-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-272-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-102-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-306-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-278-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-101-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-37-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-277-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-150-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-308-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-271-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-270-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-252-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-240-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-239-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-238-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-235-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-20-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/3896-18-0x0000000000571000-0x000000000059F000-memory.dmp

Filesize
184KB

Download
memory/3896-16-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/22424-182-0x0000000000DA0000-0x0000000001A17000-memory.dmp

Filesize
12.5MB

Download
memory/22424-164-0x0000000000DA0000-0x0000000001A17000-memory.dmp

Filesize
12.5MB

Download
memory/22424-116-0x0000000000DA0000-0x0000000001A17000-memory.dmp

Filesize
12.5MB

Download
memory/22424-151-0x0000000000DA0000-0x0000000001A17000-memory.dmp

Filesize
12.5MB

Download
memory/35720-130-0x0000000000780000-0x00000000013CA000-memory.dmp

Filesize
12.3MB

Download
memory/35720-131-0x0000000000780000-0x00000000013CA000-memory.dmp

Filesize
12.3MB

Download
memory/43108-152-0x00000000051E0000-0x00000000055E0000-memory.dmp

Filesize
4.0MB

Download
memory/43108-153-0x00000000051E0000-0x00000000055E0000-memory.dmp

Filesize
4.0MB

Download
memory/43108-149-0x0000000000DB0000-0x0000000001270000-memory.dmp

Filesize
4.8MB

Download
memory/43108-163-0x0000000000DB0000-0x0000000001270000-memory.dmp

Filesize
4.8MB

Download
memory/43108-154-0x00007FFF0ED70000-0x00007FFF0EF65000-memory.dmp

Filesize
2.0MB

Download
memory/43108-156-0x0000000074F90000-0x00000000751A5000-memory.dmp

Filesize
2.1MB

Download
memory/48468-159-0x0000000001110000-0x0000000001510000-memory.dmp

Filesize
4.0MB

Download
memory/48468-160-0x00007FFF0ED70000-0x00007FFF0EF65000-memory.dmp

Filesize
2.0MB

Download
memory/48468-162-0x0000000074F90000-0x00000000751A5000-memory.dmp

Filesize
2.1MB

Download
memory/48468-157-0x0000000000960000-0x000000000096A000-memory.dmp

Filesize
40KB

Download
memory/64840-225-0x0000019FCC200000-0x0000019FCC222000-memory.dmp

Filesize
136KB

Download
memory/65476-221-0x00007FF6ACB90000-0x00007FF6AD020000-memory.dmp

Filesize
4.6MB

Download
memory/65476-224-0x00007FF6ACB90000-0x00007FF6AD020000-memory.dmp

Filesize
4.6MB

Download
memory/194628-243-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/194628-241-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/197560-244-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp

Filesize
4.6MB

Download
memory/197560-259-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp

Filesize
4.6MB

Download
memory/197804-258-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-250-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-248-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-247-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-246-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-253-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-257-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-256-0x00000000024D0000-0x00000000024F0000-memory.dmp

Filesize
128KB

Download
memory/197804-249-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-255-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-251-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/197804-245-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/319684-273-0x00007FFF0ED70000-0x00007FFF0EF65000-memory.dmp

Filesize
2.0MB

Download
memory/319708-274-0x0000000000340000-0x0000000000401000-memory.dmp

Filesize
772KB

Download
memory/319952-284-0x0000000000570000-0x000000000088B000-memory.dmp

Filesize
3.1MB

Download
memory/320076-295-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp

Filesize
4.6MB

Download
memory/320076-279-0x00007FF6168E0000-0x00007FF616D70000-memory.dmp

Filesize
4.6MB

Download
memory/320092-291-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/320092-293-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download
memory/320092-296-0x0000000140000000-0x0000000140770000-memory.dmp

Filesize
7.4MB

Download