22627068c23fb27e7aaac9d20e3807c32324e7ff832eaa26548fd1ccfb9722ef

Analysis

max time kernel
150s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-12-2024 04:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe
Size

713KB
MD5

223c59e071cfa0c3931a18df26669606
SHA1

666735c53a6fe5569d61598b5769f180089957ba
SHA256

d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075
SHA512

671a4c67c49b722ac0b971b122d4a5724ce05ee87e4dd05f6d8c7cccc89e0c23b30e3d482d4dc564f2c1a977b0e4787d01663c46f7680444c613860d8f3355af
SSDEEP

12288:XJEm10Qb/p87R9ZUH4PJZhr3MKnkUqwSlJZRQbLv5BnPg5qC3hnuMd9A3Fu:XJT1jzp87RsHSfhDMKnkUTgZGLvbPKqI

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2920	zhwhki.exe
2792	zhwhki.exe
2380	zhwhki.exe
2912	zhwhki.exe
2936	zhwhki.exe
2816	zhwhki.exe
2788	zhwhki.exe
2864	zhwhki.exe
2780	zhwhki.exe
2700	zhwhki.exe
3044	zhwhki.exe
2692	zhwhki.exe
2800	zhwhki.exe
2832	zhwhki.exe
2856	zhwhki.exe
2660	zhwhki.exe
2696	zhwhki.exe
2740	zhwhki.exe
1504	zhwhki.exe
2156	zhwhki.exe
2292	zhwhki.exe
952	zhwhki.exe
1628	zhwhki.exe
580	zhwhki.exe
2440	zhwhki.exe
2428	zhwhki.exe
2448	zhwhki.exe
584	zhwhki.exe
2588	zhwhki.exe
1732	zhwhki.exe
1356	zhwhki.exe
2612	zhwhki.exe
2248	zhwhki.exe
2032	zhwhki.exe
640	zhwhki.exe
1992	zhwhki.exe
2652	zhwhki.exe
2972	zhwhki.exe
2952	zhwhki.exe
2948	zhwhki.exe
2988	zhwhki.exe
3040	zhwhki.exe
2764	zhwhki.exe
2984	zhwhki.exe
2468	zhwhki.exe
1216	zhwhki.exe
540	zhwhki.exe
936	zhwhki.exe
3012	zhwhki.exe
2980	zhwhki.exe
2992	zhwhki.exe
2020	zhwhki.exe
1076	zhwhki.exe
1964	zhwhki.exe
896	zhwhki.exe
2368	zhwhki.exe
2352	zhwhki.exe
2544	zhwhki.exe
1204	zhwhki.exe
2056	zhwhki.exe
760	zhwhki.exe
1668	zhwhki.exe
1372	zhwhki.exe
1644	zhwhki.exe

Loads dropped DLL 64 IoCs

pid	Process
1656	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\yfxydtqgsol = "C:\\Users\\Admin\\AppData\\Roaming\\vruvoslhvpg\\mxkcfq.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\zhwhki.exe\" \"C:\\Users\\Admin\\AppData\\Local"	zhwhki.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zhwhki.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe
2920	zhwhki.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2920	zhwhki.exe
2920	zhwhki.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2920	zhwhki.exe
2920	zhwhki.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2920	1656	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe	29
PID 1656 wrote to memory of 2920	1656	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe	29
PID 1656 wrote to memory of 2920	1656	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe	29
PID 1656 wrote to memory of 2920	1656	d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe	29
PID 2920 wrote to memory of 2380	2920	zhwhki.exe	30
PID 2920 wrote to memory of 2380	2920	zhwhki.exe	30
PID 2920 wrote to memory of 2380	2920	zhwhki.exe	30
PID 2920 wrote to memory of 2380	2920	zhwhki.exe	30
PID 2920 wrote to memory of 2792	2920	zhwhki.exe	31
PID 2920 wrote to memory of 2792	2920	zhwhki.exe	31
PID 2920 wrote to memory of 2792	2920	zhwhki.exe	31
PID 2920 wrote to memory of 2792	2920	zhwhki.exe	31
PID 2920 wrote to memory of 2912	2920	zhwhki.exe	32
PID 2920 wrote to memory of 2912	2920	zhwhki.exe	32
PID 2920 wrote to memory of 2912	2920	zhwhki.exe	32
PID 2920 wrote to memory of 2912	2920	zhwhki.exe	32
PID 2920 wrote to memory of 2936	2920	zhwhki.exe	33
PID 2920 wrote to memory of 2936	2920	zhwhki.exe	33
PID 2920 wrote to memory of 2936	2920	zhwhki.exe	33
PID 2920 wrote to memory of 2936	2920	zhwhki.exe	33
PID 2920 wrote to memory of 2816	2920	zhwhki.exe	34
PID 2920 wrote to memory of 2816	2920	zhwhki.exe	34
PID 2920 wrote to memory of 2816	2920	zhwhki.exe	34
PID 2920 wrote to memory of 2816	2920	zhwhki.exe	34
PID 2920 wrote to memory of 2788	2920	zhwhki.exe	35
PID 2920 wrote to memory of 2788	2920	zhwhki.exe	35
PID 2920 wrote to memory of 2788	2920	zhwhki.exe	35
PID 2920 wrote to memory of 2788	2920	zhwhki.exe	35
PID 2920 wrote to memory of 2864	2920	zhwhki.exe	197
PID 2920 wrote to memory of 2864	2920	zhwhki.exe	197
PID 2920 wrote to memory of 2864	2920	zhwhki.exe	197
PID 2920 wrote to memory of 2864	2920	zhwhki.exe	197
PID 2920 wrote to memory of 2780	2920	zhwhki.exe	37
PID 2920 wrote to memory of 2780	2920	zhwhki.exe	37
PID 2920 wrote to memory of 2780	2920	zhwhki.exe	37
PID 2920 wrote to memory of 2780	2920	zhwhki.exe	37
PID 2920 wrote to memory of 2700	2920	zhwhki.exe	38
PID 2920 wrote to memory of 2700	2920	zhwhki.exe	38
PID 2920 wrote to memory of 2700	2920	zhwhki.exe	38
PID 2920 wrote to memory of 2700	2920	zhwhki.exe	38
PID 2920 wrote to memory of 3044	2920	zhwhki.exe	39
PID 2920 wrote to memory of 3044	2920	zhwhki.exe	39
PID 2920 wrote to memory of 3044	2920	zhwhki.exe	39
PID 2920 wrote to memory of 3044	2920	zhwhki.exe	39
PID 2920 wrote to memory of 2692	2920	zhwhki.exe	202
PID 2920 wrote to memory of 2692	2920	zhwhki.exe	202
PID 2920 wrote to memory of 2692	2920	zhwhki.exe	202
PID 2920 wrote to memory of 2692	2920	zhwhki.exe	202
PID 2920 wrote to memory of 2800	2920	zhwhki.exe	41
PID 2920 wrote to memory of 2800	2920	zhwhki.exe	41
PID 2920 wrote to memory of 2800	2920	zhwhki.exe	41
PID 2920 wrote to memory of 2800	2920	zhwhki.exe	41
PID 2920 wrote to memory of 2832	2920	zhwhki.exe	42
PID 2920 wrote to memory of 2832	2920	zhwhki.exe	42
PID 2920 wrote to memory of 2832	2920	zhwhki.exe	42
PID 2920 wrote to memory of 2832	2920	zhwhki.exe	42
PID 2920 wrote to memory of 2856	2920	zhwhki.exe	43
PID 2920 wrote to memory of 2856	2920	zhwhki.exe	43
PID 2920 wrote to memory of 2856	2920	zhwhki.exe	43
PID 2920 wrote to memory of 2856	2920	zhwhki.exe	43
PID 2920 wrote to memory of 2660	2920	zhwhki.exe	44
PID 2920 wrote to memory of 2660	2920	zhwhki.exe	44
PID 2920 wrote to memory of 2660	2920	zhwhki.exe	44
PID 2920 wrote to memory of 2660	2920	zhwhki.exe	44

C:\Users\Admin\AppData\Local\Temp\d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe
"C:\Users\Admin\AppData\Local\Temp\d3cd3076d9df007e13f80cb032ccceefb8017ef6f3ea80cc02b5f0f737405075.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
  "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:640
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1992
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2652
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    - Executes dropped EXE
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2840
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2036
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2648
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1188
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1236
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1744
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3028
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2872
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:848
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2344
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2372
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1084
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:848
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2444
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1876
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2388
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2000
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2004
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1300
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2616
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1564
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2316
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2240
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1152
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2500
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2464
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2752
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2968
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3024
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2512
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:848
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3004
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1664
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2424
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2368
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2444
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2132
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2460
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1640
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1368
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3048
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1536
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1672
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1196
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2172
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2456
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:968
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:328
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2956
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2784
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2680
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1812
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2284
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2124
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1596
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2924
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2120
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2396
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2792
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2380
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2940
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2464
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2912
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2816
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2788
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2700
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3044
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2800
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2720
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2736
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2300
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2352
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:760
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2084
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2932
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:976
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2064
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1016
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1528
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2400
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2128
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2108
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2176
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2236
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2384
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2152
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:676
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2348
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2200
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1684
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2040
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2432
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1164
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2264
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2684
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1784
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1780
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1624
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2644
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2836
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1708
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2104
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3000
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2340
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1484
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1724
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2524
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2916
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1748
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1712
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:920
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2028
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2320
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1652
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:940
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:996
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2436
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2552
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2416
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1168
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1692
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2260
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:568
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2092
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:548
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1080
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:868
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2592
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2408
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1604
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1720
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2744
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3036
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2852
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2256
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2228
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2880
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1636
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2804
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2772
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2884
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2824
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1576
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2844
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3052
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2828
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2476
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2832
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2856
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2660
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2696
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2740
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2480
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2960
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2156
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2292
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1628
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:580
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2440
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2448
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:584
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2588
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1732
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1356
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2612
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2248
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1472
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2988
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2948
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3040
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2764
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2984
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2468
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:540
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3012
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:936
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2980
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2992
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1076
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1964
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2688
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1312
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2192
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2900
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2232
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2276
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2704
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2056
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1644
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1488
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:316
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:824
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1820
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1768
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2376
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2840
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1328
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1872
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2100
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2088
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2184
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2364
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2812
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2208
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2224
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:972
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2768
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2204
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2032
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2508
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2392
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2216
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2668
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2412
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1952
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2728
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2160
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1756
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2164
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2272
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2136
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:280
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2096
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1288
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:928
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:3060
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2496
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1520
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1808
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1752
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2564
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:560
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2776
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2624
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1492
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2620
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:1048
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:864
- - C:\Users\Admin\AppData\Local\Temp\zhwhki.exe
    "C:\Users\Admin\AppData\Local\Temp\zhwhki.exe" "C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3"
    3⤵
    PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nmujchogun.bb

Filesize
53KB

MD5
01eabf752d917ea6bc3e83563d640368

SHA1
dff891efb9de9dcda0cf5ddf89bca67b4a8c8f30

SHA256
e50d59e6aece1387c1ff5fb6f50e67f356b07955e52326f0a19989e7c677e48e

SHA512
6e71efac490655e85264481f9ddecdd2748105b3620eb0fccf27f0eeebbfa1bda7b9dd8f186fa3ada1606fd87157a51642a163d7896c9e55d1db12d58253e3a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\xgvxyzvxwt.au3

Filesize
6KB

MD5
cea25eafec4235e42120c4492dc98b5c

SHA1
fa9a75cc2cdea3d78241b2b48573f0d7b75e9bc3

SHA256
dde1986fe665769b139c1f90acde795ba56c87d3cf919cde2d17ba2a65f1a47b

SHA512
dbe16e29af68d885790bf01b8f72de1879714ddc0f9e939fd169b5507966fc91df96de6c0dc1110482e16f7f1eeca0f9e5c546d151686b1251790e6197ffbc50

Download Submit
C:\Users\Admin\AppData\Local\Temp\znnjudnkavc.m

Filesize
205KB

MD5
c4ad82ba37dbdb7e89edece563b3c1ff

SHA1
4eeccaee473845b06d8673bc3efefc1a00ef1ea2

SHA256
10631ac0a6e56ebfe89c9104add048e329b5cefab124248144d13a5335639614

SHA512
2f971d4645a1704f7507b14c0031967a2355038f7ac439fa6750c7771b58572921be72281802097d1250e7da504fea620115f1d25352ee05ffe6d1ab01a9645e

Download Submit
\Users\Admin\AppData\Local\Temp\zhwhki.exe

Filesize
925KB

MD5
0adb9b817f1df7807576c2d7068dd931

SHA1
4a1b94a9a5113106f40cd8ea724703734d15f118

SHA256
98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b

SHA512
883aa88f2dba4214bb534fbdaf69712127357a3d0f5666667525db3c1fa351598f067068dfc9e7c7a45fed4248d7dca729ba4f75764341e47048429f9ca8846a

Download Submit
memory/2920-10-0x0000000000160000-0x0000000000162000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads