amadey | 998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Size

2.8MB
MD5

a0956c9f9c719b85668c6f8b85f89a5b
SHA1

031f8c3bf791e31ae9b03286b486b1365b81f745
SHA256

998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57
SHA512

1ee084ef14a516733ffaedd360b43560bf87e999fc4f2ad9c8d34191f33e6fafde7bd0773cc422f63d664e8b8d994d1884736f70c360927aaef75745323b8474
SSDEEP

24576:LBGJABbey9EKIXUDMPygZalHOiZncFx2J/atbmmPffRv7P8ussEsfEEi3M4rz7Jf:lKABDZIXUI5iuiZ29zmuarfkjpTSyng

Score

10^/10

amadey cryptbot lumma stealc 9c9aa5 stok credential_access discovery evasion persistence spyware stealer trojan upx

Malware Config

Extracted

Family

stealc

Botnet

stok

http://185.215.113.206

Attributes

url_path
/c4becf79229cb002.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

http://185.215.113.43

Attributes

install_dir
abc3bc1985
install_file
skotes.exe
strings_key
8a35cf2ea38c2817dba29a4b5b25dcf0
url_paths
/Zu7JuNko/index.php

rc4.plain

Extracted

Family

cryptbot

Extracted

Family

lumma

https://pollution-raker.cyou/api

https://hosue-billowy.cyou/api

https://ripe-blade.cyou/api

https://smash-boiling.cyou/api

https://supporse-comment.cyou/api

https://greywe-snotty.cyou/api

https://steppriflej.xyz/api

https://sendypaster.xyz/api

https://cuddlyready.xyz/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
CryptBot
CryptBot is a C++ stealer distributed widely in bundle with other software.
spyware stealer cryptbot
Cryptbot family
cryptbot
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc

Enumerates VirtualBox registry keys 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	Process not Found

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	IECFHDBAAE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	skotes.exe

Downloads MZ/PE file

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2252	chrome.exe
1120	chrome.exe
1776	msedge.exe
4292	msedge.exe
4700	chrome.exe
3568	chrome.exe
1332	chrome.exe
2628	msedge.exe
4492	msedge.exe
3660	msedge.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	IECFHDBAAE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	IECFHDBAAE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	skotes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	IECFHDBAAE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	skotes.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
1776	IECFHDBAAE.exe
3400	skotes.exe
3880	O8FeZRE.exe
3488	e6a4c54bd5.exe
112	c4fe6e296b.exe
4812	c4fe6e296b.exe
3644	c4fe6e296b.exe
1508	c4fe6e296b.exe
1616	c4fe6e296b.exe
3980	c4fe6e296b.exe
1828	c4fe6e296b.exe
764	c4fe6e296b.exe
4496	c4fe6e296b.exe
5096	c4fe6e296b.exe
2000	c4fe6e296b.exe
3584	c4fe6e296b.exe
1128	c4fe6e296b.exe
2988	c4fe6e296b.exe
2932	c4fe6e296b.exe
5008	c4fe6e296b.exe
3520	c4fe6e296b.exe
1340	c4fe6e296b.exe
4356	c4fe6e296b.exe
4132	c4fe6e296b.exe
3116	c4fe6e296b.exe
3800	c4fe6e296b.exe
2564	c4fe6e296b.exe
4756	c4fe6e296b.exe
4368	c4fe6e296b.exe
3956	c4fe6e296b.exe
4016	c4fe6e296b.exe
2084	c4fe6e296b.exe
2324	c4fe6e296b.exe
452	c4fe6e296b.exe
4816	c4fe6e296b.exe
4600	c4fe6e296b.exe
3128	c4fe6e296b.exe
1232	c4fe6e296b.exe
1896	c4fe6e296b.exe
212	c4fe6e296b.exe
636	c4fe6e296b.exe
1700	c4fe6e296b.exe
3576	c4fe6e296b.exe
2896	c4fe6e296b.exe
1972	c4fe6e296b.exe
2684	c4fe6e296b.exe
3656	c4fe6e296b.exe
4312	c4fe6e296b.exe
1016	c4fe6e296b.exe
3856	c4fe6e296b.exe
3092	c4fe6e296b.exe
2584	c4fe6e296b.exe
2484	c4fe6e296b.exe
3232	c4fe6e296b.exe
2748	c4fe6e296b.exe
2772	c4fe6e296b.exe
4736	c4fe6e296b.exe
5036	c4fe6e296b.exe
468	c4fe6e296b.exe
4644	c4fe6e296b.exe
2336	c4fe6e296b.exe
4140	c4fe6e296b.exe
4700	c4fe6e296b.exe
4264	c4fe6e296b.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	skotes.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key opened	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Software\Wine	IECFHDBAAE.exe

Loads dropped DLL 2 IoCs

pid	Process
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\7734088a54.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020333001\\7734088a54.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\d0c04e33d0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020334001\\d0c04e33d0.exe"	skotes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\de8ee7198b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1020332001\\de8ee7198b.exe"	skotes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
218	drive.google.com
219	drive.google.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
243	ipinfo.io
244	ipinfo.io

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000300000000073f-739.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
56832	Process not Found
68880	Process not Found

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1776	IECFHDBAAE.exe
3400	skotes.exe
8392	skotes.exe
51164	Process not Found
66072	Process not Found
74764	Process not Found

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/118200-1832-0x00007FF7756E0000-0x00007FF775B70000-memory.dmp	upx

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\skotes.job	IECFHDBAAE.exe
File opened for modification	C:\Windows\OmissionsEmerald	Process not Found
File opened for modification	C:\Windows\BaconTicket	Process not Found
File opened for modification	C:\Windows\SodiumLegend	Process not Found
File opened for modification	C:\Windows\KrugerPowers	Process not Found
File opened for modification	C:\Windows\GradVitamins	Process not Found
File opened for modification	C:\Windows\ScienceCom	Process not Found
File opened for modification	C:\Windows\FarmingDesignation	Process not Found
File opened for modification	C:\Windows\RenewableProgramme	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c4fe6e296b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	O8FeZRE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	skotes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IECFHDBAAE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e6a4c54bd5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 5 IoCs

evasion

pid	Process
89540	Process not Found
82940	Process not Found
88544	Process not Found
88952	Process not Found
89188	Process not Found

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133793640520501451"	chrome.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
4700	chrome.exe
4700	chrome.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
2928	msedge.exe
2928	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
2628	msedge.exe
2628	msedge.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
1776	IECFHDBAAE.exe
1776	IECFHDBAAE.exe
3400	skotes.exe
3400	skotes.exe
8392	skotes.exe
8392	skotes.exe
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
51164	Process not Found
66072	Process not Found
66072	Process not Found
74764	Process not Found
74764	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
82468	Process not Found
82468	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeShutdownPrivilege	4700	chrome.exe
Token: SeCreatePagefilePrivilege	4700	chrome.exe
Token: SeDebugPrivilege	56832	Process not Found
Token: SeDebugPrivilege	68880	Process not Found
Token: SeDebugPrivilege	82940	Process not Found
Token: SeDebugPrivilege	88544	Process not Found
Token: SeDebugPrivilege	88952	Process not Found
Token: SeDebugPrivilege	89188	Process not Found
Token: SeDebugPrivilege	89540	Process not Found

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
4700	chrome.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
82468	Process not Found
82468	Process not Found
82468	Process not Found
82468	Process not Found
82468	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
82468	Process not Found
82468	Process not Found

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
82468	Process not Found
82468	Process not Found
82468	Process not Found
82468	Process not Found
82468	Process not Found
88256	Process not Found
88256	Process not Found
88256	Process not Found
82468	Process not Found
82468	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 4700	1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe	82
PID 1448 wrote to memory of 4700	1448	998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe	82
PID 4700 wrote to memory of 4040	4700	chrome.exe	83
PID 4700 wrote to memory of 4040	4700	chrome.exe	83
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 1228	4700	chrome.exe	84
PID 4700 wrote to memory of 2088	4700	chrome.exe	85
PID 4700 wrote to memory of 2088	4700	chrome.exe	85
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86
PID 4700 wrote to memory of 2788	4700	chrome.exe	86

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
103388	Process not Found

C:\Users\Admin\AppData\Local\Temp\998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe
"C:\Users\Admin\AppData\Local\Temp\998c8dddf5fc3d73a386669c03ce5a4d371fb1d09983b1828f3ed49598af0b57.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff5756cc40,0x7fff5756cc4c,0x7fff5756cc58
    3⤵
    PID:4040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2024,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:1228
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1940,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
    3⤵
    PID:2088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1988,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2480 /prefetch:8
    3⤵
    PID:2788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3328 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4216 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4208,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4788 /prefetch:8
    3⤵
    PID:3880
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4788,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:8
    3⤵
    PID:3840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4824,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5076 /prefetch:8
    3⤵
    PID:1608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4772 /prefetch:8
    3⤵
    PID:2372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4960,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5080 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:5112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5028,i,15140098868697291136,12078442725838475024,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5240 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
  2⤵
  - Uses browser remote debugging
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff575746f8,0x7fff57574708,0x7fff57574718
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2380 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3008 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --remote-debugging-port=9229 --field-trial-handle=2036,2391380492201749303,10319565232043100890,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3660
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\Admin\Documents\IECFHDBAAE.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3576
- - C:\Users\Admin\Documents\IECFHDBAAE.exe
    "C:\Users\Admin\Documents\IECFHDBAAE.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
      "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Checks computer location settings
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\1020325001\e6a4c54bd5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020325001\e6a4c54bd5.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3488
    - - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3644
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2000
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4132
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:452
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1896
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3656
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:1016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2484
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:2336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        Executes dropped EXE
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4080
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1376
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2612
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2044
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3300
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2272
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2280
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1692
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2816
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3304
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1780
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6296
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6768
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7436
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7548
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7692
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7716
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7804
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8052
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8172
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8484
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8492
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:3916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9340
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9364
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9436
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9628
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9708
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9876
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9964
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10028
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10084
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10372
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10468
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11248
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11288
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11360
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11368
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11496
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11680
      - C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe
        
        "C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe"
        6⤵
        
        PID:11688

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5020

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:8392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

T1556

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\mozglue.dll

Filesize
593KB

MD5
c8fd9be83bc728cc04beffafc2907fe9

SHA1
95ab9f701e0024cedfbd312bcfe4e726744c4f2e

SHA256
ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

SHA512
fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

Download Submit
C:\ProgramData\nss3.dll

Filesize
2.0MB

MD5
1cc453cdf74f31e4d913ff9c10acdde2

SHA1
6e85eae544d6e965f15fa5c39700fa7202f3aafe

SHA256
ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

SHA512
dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
5c3fa76b8d636d4d328a275836c723c9

SHA1
83353089e094e7478b4866db1d24e124cdc8a7a8

SHA256
93be6a9a1fd42d9efef998b871ff71487d9c518ddb88218628327bc3cb6fa3c4

SHA512
8db2d1613242e5925c542ce47a8ac1bd6885b0f57d0887a4bdeb9dcc436905f5b77ce7d6921925c700d2647ef46354f76b7cb9e52816d7bc23aa76940590fbbb

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27d5ebf3-9cb6-4c86-94ff-7fec03f8c0ab.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ce4075e634aa978f71c07ef19486875a

SHA1
9760d43e2ead3dd70435b58573b996f783409860

SHA256
b53eeaf4abbabbfc0e3c6a5c326610a428803eb8ac5f9d86b84bbcf734c03b97

SHA512
6094262466116f98401a3ea4effef7d529175f4047b777c6d27de5553de44cabaec53c4feb959f5db23ef6159b7afa267158662fb85f1ecd553f6930885d4923

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020068001\O8FeZRE.exe

Filesize
295KB

MD5
ef9b9ffab9d91e590c6bda0280686d52

SHA1
bcbdca605606f483e76ae821b7bf81ca3e1b529a

SHA256
1345ad4c782c91049a16ec9f01b04bfc83a4f0e1e259cfed2b535f8ec6b75590

SHA512
3b362b306ba8357ac2eecd7354799e203d42fdee849584b26ee2c4c7b2c632c64558fd84f22c1dff35957f6950e333d005a225a54bdab4b3f53812041ea6345c

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020325001\e6a4c54bd5.exe

Filesize
2.5MB

MD5
87330f1877c33a5a6203c49075223b16

SHA1
55b64ee8b2d1302581ab1978e9588191e4e62f81

SHA256
98f2344ed45ff0464769e5b006bf0e831dc3834f0534a23339bb703e50db17e0

SHA512
7c747d3edb04e4e71dce7efa33f5944a191896574fee5227316739a83d423936a523df12f925ee9b460cce23b49271f549c1ee5d77b50a7d7c6e3f31ba120c8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020326001\c4fe6e296b.exe

Filesize
758KB

MD5
afd936e441bf5cbdb858e96833cc6ed3

SHA1
3491edd8c7caf9ae169e21fb58bccd29d95aefef

SHA256
c6491d7a6d70c7c51baca7436464667b4894e4989fa7c5e05068dde4699e1cbf

SHA512
928c15a1eda602b2a66a53734f3f563ab9626882104e30ee2bf5106cfd6e08ec54f96e3063f1ab89bf13be2c8822a8419f5d8ee0a3583a4c479785226051a325

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020327001\7a1fb26747.exe

Filesize
1.2MB

MD5
5a909c9769920208ed3d4d7279f08de5

SHA1
656f447088626150e252cbf7df6f8cd0de596fa0

SHA256
5f2c26e780639a76f10c549e7dea1421c4f06093c1facbf4dd8cf0a8b2fee8cb

SHA512
c6038048bd09c8f704246a6ba176ea63b1c8d23f2e127600c50bac50f3032c1b751ea8e405a2fe1ea707f75f21cf6516447345a84751bc677d94874d4b91090b

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020330001\ec80df9d48.exe

Filesize
4.3MB

MD5
3196bde966d070a54658abbfd66a0f4e

SHA1
7014bc8b36f162fa42e0de2b8f67f7ac6a4b197a

SHA256
38882fc16840014780f2186955fe0305b190824204db1ac6cc44e0be84fbf33c

SHA512
38b3d4d81a386daf9a7648bca7b36a7b7ae3b7e0ecc40e414a9672883330caa10e6ec89b866bbc418e9a45c747d59ec2c2a89787d36767872a92cc1a09cc7028

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020332001\de8ee7198b.exe

Filesize
1.8MB

MD5
6fbd41684733589dbf219d0e97216b3a

SHA1
74dbe50d6ed6a08daaee3be51891ccd62891289b

SHA256
d998502c59d03b032ac75f6ffd1cda97988469a13aa132d920b18507fc416ac5

SHA512
55e6751e0ed59cd1893cd1b54c4d1a0db93aee068e6aec45f146c4c1a2bce64a5b66ed34c6c6a6d45b6c4fe04ddbf66e4dc1374980ea7c3d01a544ce3dc4ac70

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020333001\7734088a54.exe

Filesize
2.7MB

MD5
d933d6c326e50e4a62120b54388835cf

SHA1
6a949e42b0a2bd79b71c5b975f7eb47720739441

SHA256
af38975a6500ce6aad401976da02c586478de2e9d85e76a7550acd3796040d30

SHA512
c2ec1376cfe31fd2327f6c9f0f27871d13c1e82405fa58c6a9492bc1b507a22887c03ac345e56d4842dd02c27fc46522339257df91f67d433ead351621e67f51

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020334001\d0c04e33d0.exe

Filesize
945KB

MD5
8e187e9079ce70c376e22941cd5e50c9

SHA1
871234534fb0a35a5201243701c64111132b8a60

SHA256
4577b656d36ea0f938fc695eb7fe73c459b2b7c2e916bea9d846216b0228962c

SHA512
c7c57269c824f973bc41a98cdc7aaef86b4252cda99995028356bbd4ad27ed52ec1359e8387c4fa1fe6d3f16c867265710e4ade35d68a504fac7c1dcd2934d5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020335001\7e94c2828b.exe

Filesize
2.7MB

MD5
b942b1f3b345a165ea8980f1df534b41

SHA1
cf7852d469b04cdbed63a6a83a50922a153638e6

SHA256
ca7b990bfd1a60c9f98f18d74b6d06a1737b39e8a63c12eec91051c9857c6f77

SHA512
e4f05511d695f9931d5eac1974fba82ee7a44edf6bc5276cfa9b0dedba4709b47fb8469c4d25ed3e11f18044560ae8f11c879488cf6a9af6182515659d66428a

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020337001\df7cf1d12a.exe

Filesize
4.2MB

MD5
3a425626cbd40345f5b8dddd6b2b9efa

SHA1
7b50e108e293e54c15dce816552356f424eea97a

SHA256
ba9212d2d5cd6df5eb7933fb37c1b72a648974c1730bf5c32439987558f8e8b1

SHA512
a7538c6b7e17c35f053721308b8d6dc53a90e79930ff4ed5cffecaa97f4d0fbc5f9e8b59f1383d8f0699c8d4f1331f226af71d40325022d10b885606a72fe668

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020339001\d3d3cb2a58.exe

Filesize
591KB

MD5
3567cb15156760b2f111512ffdbc1451

SHA1
2fdb1f235fc5a9a32477dab4220ece5fda1539d4

SHA256
0285d3a6c1ca2e3a993491c44e9cf2d33dbec0fb85fdbf48989a4e3b14b37630

SHA512
e7a31b016417218387a4702e525d33dd4fe496557539b2ab173cec0cb92052c750cfc4b3e7f02f3c66ac23f19a0c8a4eb6c9d2b590a5e9faeb525e517bc877ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\1020340001\806d14f26d.exe

Filesize
4.2MB

MD5
8cac713976d6a4a37a78009cb0da5e85

SHA1
1d2fc99cb4e8b10cdfc62789ea280add1c19183f

SHA256
4c7404daf821da3e3897873cfcbda864c203ae6231ea144a8d883f06c36d7930

SHA512
c1d8a1165f51d7240b8b3c3ca5c5d604f38ce2c9257415d89901e58cc0ef7a41e47eb734ba2c589cddf82513c44ec332003dd8b4856e18e25524f1e46794985a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Podcasts.cmd

Filesize
19KB

MD5
270e797dcc891238ecb4753b12ad9740

SHA1
2714eaaf585411ca91ee2ffb905d6271bfee6d9e

SHA256
2b87d3a5678436374f66000bc263763f35d1662b675f004b55002cb4f473a3d0

SHA512
409f2d91ea614e28a6a966cc52769bedd8786d1e655629da544d93a9d0547c8d151798f3f5010e11cd4308d58a419616dc35a4273df17afb94022a29f6f26a64

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4700_937575491\CRX_INSTALL\_locales\en\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir4700_937575491\c540cc3f-6180-44e9-916e-a8e7b8cbb0b2.tmp

Filesize
150KB

MD5
14937b985303ecce4196154a24fc369a

SHA1
ecfe89e11a8d08ce0c8745ff5735d5edad683730

SHA256
71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

SHA512
1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
17KB

MD5
1b71f5d4d5412de23462ae0c29c87d1e

SHA1
7dca58fc9a5c8aa6be3e245164ae58d0bd1199f4

SHA256
3c2e29742c7c6df5e9b2c2cb1302c7318fa4bf528d7a1184f51e2320e47cacac

SHA512
1eef27cfc379d100e87fbd2b9a90e3954d034b043ab55b7afe4fc90e7463b6f857ed17167b67b66613a221eb9dfb70bc2ee74bb4014788c9a25a609e8dc3c80a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\AlternateServices.bin

Filesize
6KB

MD5
034fda7df2b8c78c43a2c03986a90f89

SHA1
8b1acba7b6e4d2312e3af9dda3ded3e1a6506123

SHA256
630c763fed7975789dd1209b189cf80d48e36c071f27cf7a79e7f116bdf34728

SHA512
140c4aa3834f8bc9b1f46c24a5fee49910d45e6625b9e4d2fb44044d20f0cad16698ec111b908d70cd62d7063d141dedc78f999d6163d3998555f7e5a78b127f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
8c0330f322429ab168bbbb28b87af6f9

SHA1
f4b205c7e0eb2db77a33b02886b4778b2fa64f2c

SHA256
32c1df85d6cc9dfa463119ec62cbb9ba62f0a196a6e19cfbc5774fba676d6f9f

SHA512
28e428b64ec90b70b273256a5eaac02cc7e88aee9bad495d56c912b6230ebd66fe24305c1e7af8146bb04205bb59297913f0bb11e23a49d0f75bd92bfd446619

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\4bb517e9-2bcc-4a7a-8071-b84dbc2e5443

Filesize
25KB

MD5
a74619aa69a56aa8cf460e1a468d25d3

SHA1
36a18708b39337ab50a57255339fc38324dd232f

SHA256
03e57dae04a2e3520fb1313af52ccdd7084627dcfd1a491a82876db8a260aac4

SHA512
f5142fff654f5f86beefead665c0734659c2118bbd7e4b94ec098793ef5118b308afe1bbff2fad7bac12ce1348b5fb3d9ee5780368abb5b662355516ccc1ec7f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\cff2b1e8-633f-48b9-af65-df638ce6dd4b

Filesize
671B

MD5
f80952e1b4bce58f08c114cf5236efe6

SHA1
4b1914d7757b7c251f1f11592091bba78d898ec2

SHA256
47306869e54f919aed183f31af0125dbc0f490b1ae51b2fdcd118d6e38bacb0c

SHA512
e0b44df35025bf9f367a3704174c3b31e6ae8451320b38370c37b8e782be1e9a2d1fe27b4aedadbc44ebfb5ea68857d3a24c09b80833b1967007aa1849831359

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\datareporting\glean\pending_pings\eb2057bd-b596-4f7f-85c2-9895a25f6242

Filesize
982B

MD5
f84a11142f23e9efc257f796097e57b4

SHA1
abc5bbc35f6e4f3a2832b1e83420b4ca6b07e19a

SHA256
24670d731f267a55ce59ecdfef42452aab6460c21683bc95a2f8c1a1967cea72

SHA512
4af5b38e0c783625a02c7d2dfa3741f168e2b69cdb84dce69b71918fe484adf22526332086a1eb6d786745c919cd6ed6a30f469362ef454136a2c695d3748e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n4zftpal.default-release\prefs.js

Filesize
10KB

MD5
7c45274e0a90dc040f5ac578d500840d

SHA1
349b20a7ed782ec91130f897c30299c27565225e

SHA256
e56574abeaf8aa9c03beadc8e305707f5d67daf0b5f2ab20c95bd2181bc67d58

SHA512
e790065b4634d0f19083efaaaf79d2ba6631c8762ebe191c0200860505f571acc6fda932b5077a8b85a89cd63c5ddc4ccd4ffc13c9236c10dd6d5485b392ce56

Download Submit
C:\Users\Admin\Documents\IECFHDBAAE.exe

Filesize
3.1MB

MD5
a6f6891fa625bb88fb785f4298b7d9cb

SHA1
af3b8422ea1782dcea0bd0273aae8ccc8af394d1

SHA256
fb61ce1f44e6dac66f74913139901ff98a67dd41067b6c1026c3b60e5780b29d

SHA512
dbfb769e72e61db186105cdc2e114658b9f71928a6db7bcf87f5fb69fe5c3c5fe85446bb721d22add887fa87633dde76ce24f37e11cc648842fe8b48004a003c

Download Submit
memory/1448-493-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-4-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/1448-1-0x0000000077904000-0x0000000077906000-memory.dmp

Filesize
8KB

Download
memory/1448-2-0x0000000000E81000-0x0000000000E98000-memory.dmp

Filesize
92KB

Download
memory/1448-3-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-148-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-445-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-447-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-0-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-500-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-504-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1448-536-0x0000000000E80000-0x0000000001376000-memory.dmp

Filesize
5.0MB

Download
memory/1776-549-0x00000000000D0000-0x00000000003F6000-memory.dmp

Filesize
3.1MB

Download
memory/1776-535-0x00000000000D0000-0x00000000003F6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-566-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-587-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-743-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-649-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-550-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-698-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/3400-1656-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/4856-1643-0x0000000000400000-0x0000000000C54000-memory.dmp

Filesize
8.3MB

Download
memory/8392-638-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/8392-636-0x0000000000BD0000-0x0000000000EF6000-memory.dmp

Filesize
3.1MB

Download
memory/51164-713-0x00000000004C0000-0x0000000001143000-memory.dmp

Filesize
12.5MB

Download
memory/51164-727-0x00000000004C0000-0x0000000001143000-memory.dmp

Filesize
12.5MB

Download
memory/51164-684-0x00000000004C0000-0x0000000001143000-memory.dmp

Filesize
12.5MB

Download
memory/66072-712-0x0000000000980000-0x0000000000E18000-memory.dmp

Filesize
4.6MB

Download
memory/66072-1764-0x0000000000980000-0x0000000000E18000-memory.dmp

Filesize
4.6MB

Download
memory/66072-755-0x0000000000980000-0x0000000000E18000-memory.dmp

Filesize
4.6MB

Download
memory/66072-754-0x0000000000980000-0x0000000000E18000-memory.dmp

Filesize
4.6MB

Download
memory/74764-728-0x00000000006C0000-0x0000000000BAA000-memory.dmp

Filesize
4.9MB

Download
memory/74764-730-0x00000000006C0000-0x0000000000BAA000-memory.dmp

Filesize
4.9MB

Download
memory/88256-1325-0x00000000043A0000-0x00000000043F5000-memory.dmp

Filesize
340KB

Download
memory/90324-1188-0x00000000000F0000-0x00000000003A0000-memory.dmp

Filesize
2.7MB

Download
memory/90324-992-0x00000000000F0000-0x00000000003A0000-memory.dmp

Filesize
2.7MB

Download
memory/90324-991-0x00000000000F0000-0x00000000003A0000-memory.dmp

Filesize
2.7MB

Download
memory/90324-778-0x00000000000F0000-0x00000000003A0000-memory.dmp

Filesize
2.7MB

Download
memory/91524-1171-0x00000000008D0000-0x0000000000D68000-memory.dmp

Filesize
4.6MB

Download
memory/103408-1367-0x000002201C480000-0x000002201C4A2000-memory.dmp

Filesize
136KB

Download
memory/117280-1765-0x0000000000400000-0x0000000001068000-memory.dmp

Filesize
12.4MB

Download
memory/117280-1799-0x0000000000400000-0x0000000001068000-memory.dmp

Filesize
12.4MB

Download
memory/118200-1832-0x00007FF7756E0000-0x00007FF775B70000-memory.dmp

Filesize
4.6MB

Download