6d38c8152edc5634fa7cae67424a5b28e1dca4b1037d99704c331c91faca77b7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 10:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

drop1.exe
Size

2.4MB
MD5

cf2ac2dce038a884fce94f9350327033
SHA1

a2d1c361993e3b1b3289e4905287cb2c9a1714de
SHA256

6d38c8152edc5634fa7cae67424a5b28e1dca4b1037d99704c331c91faca77b7
SHA512

635c847a0dba3dea3a902ab2394f466c7230e5d355c5a2aa6364b83fd7f9ab6bcc194d2dc6ae6d3b3b9623bfe110d3222bfddb2b5987ca77d95b7d871ef7a1df
SSDEEP

49152:mGnxuIaLAA4B6oztxtwt81xuIaLAA4B6oztxtwt8N:mi1NvztxuG1NvztxuU

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
319464	2468	Process not Found	82

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	drop1.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2468 wrote to memory of 4280	2468	drop1.exe	84
PID 2468 wrote to memory of 4280	2468	drop1.exe	84
PID 2468 wrote to memory of 4280	2468	drop1.exe	84
PID 2468 wrote to memory of 4952	2468	drop1.exe	85
PID 2468 wrote to memory of 4952	2468	drop1.exe	85
PID 2468 wrote to memory of 4952	2468	drop1.exe	85
PID 2468 wrote to memory of 1204	2468	drop1.exe	86
PID 2468 wrote to memory of 1204	2468	drop1.exe	86
PID 2468 wrote to memory of 1204	2468	drop1.exe	86
PID 2468 wrote to memory of 936	2468	drop1.exe	87
PID 2468 wrote to memory of 936	2468	drop1.exe	87
PID 2468 wrote to memory of 936	2468	drop1.exe	87
PID 2468 wrote to memory of 1768	2468	drop1.exe	88
PID 2468 wrote to memory of 1768	2468	drop1.exe	88
PID 2468 wrote to memory of 1768	2468	drop1.exe	88
PID 2468 wrote to memory of 3428	2468	drop1.exe	89
PID 2468 wrote to memory of 3428	2468	drop1.exe	89
PID 2468 wrote to memory of 3428	2468	drop1.exe	89
PID 2468 wrote to memory of 4796	2468	drop1.exe	90
PID 2468 wrote to memory of 4796	2468	drop1.exe	90
PID 2468 wrote to memory of 4796	2468	drop1.exe	90
PID 2468 wrote to memory of 3956	2468	drop1.exe	91
PID 2468 wrote to memory of 3956	2468	drop1.exe	91
PID 2468 wrote to memory of 3956	2468	drop1.exe	91
PID 2468 wrote to memory of 4212	2468	drop1.exe	92
PID 2468 wrote to memory of 4212	2468	drop1.exe	92
PID 2468 wrote to memory of 4212	2468	drop1.exe	92
PID 2468 wrote to memory of 4232	2468	drop1.exe	93
PID 2468 wrote to memory of 4232	2468	drop1.exe	93
PID 2468 wrote to memory of 4232	2468	drop1.exe	93
PID 2468 wrote to memory of 4108	2468	drop1.exe	94
PID 2468 wrote to memory of 4108	2468	drop1.exe	94
PID 2468 wrote to memory of 4108	2468	drop1.exe	94
PID 2468 wrote to memory of 4736	2468	drop1.exe	95
PID 2468 wrote to memory of 4736	2468	drop1.exe	95
PID 2468 wrote to memory of 4736	2468	drop1.exe	95
PID 2468 wrote to memory of 4904	2468	drop1.exe	96
PID 2468 wrote to memory of 4904	2468	drop1.exe	96
PID 2468 wrote to memory of 4904	2468	drop1.exe	96
PID 2468 wrote to memory of 5112	2468	drop1.exe	97
PID 2468 wrote to memory of 5112	2468	drop1.exe	97
PID 2468 wrote to memory of 5112	2468	drop1.exe	97
PID 2468 wrote to memory of 4160	2468	drop1.exe	98
PID 2468 wrote to memory of 4160	2468	drop1.exe	98
PID 2468 wrote to memory of 4160	2468	drop1.exe	98
PID 2468 wrote to memory of 392	2468	drop1.exe	99
PID 2468 wrote to memory of 392	2468	drop1.exe	99
PID 2468 wrote to memory of 392	2468	drop1.exe	99
PID 2468 wrote to memory of 2484	2468	drop1.exe	100
PID 2468 wrote to memory of 2484	2468	drop1.exe	100
PID 2468 wrote to memory of 2484	2468	drop1.exe	100
PID 2468 wrote to memory of 4956	2468	drop1.exe	101
PID 2468 wrote to memory of 4956	2468	drop1.exe	101
PID 2468 wrote to memory of 4956	2468	drop1.exe	101
PID 2468 wrote to memory of 244	2468	drop1.exe	102
PID 2468 wrote to memory of 244	2468	drop1.exe	102
PID 2468 wrote to memory of 244	2468	drop1.exe	102
PID 2468 wrote to memory of 1968	2468	drop1.exe	103
PID 2468 wrote to memory of 1968	2468	drop1.exe	103
PID 2468 wrote to memory of 1968	2468	drop1.exe	103
PID 2468 wrote to memory of 4436	2468	drop1.exe	104
PID 2468 wrote to memory of 4436	2468	drop1.exe	104
PID 2468 wrote to memory of 4436	2468	drop1.exe	104
PID 2468 wrote to memory of 1976	2468	drop1.exe	105

C:\Users\Admin\AppData\Local\Temp\drop1.exe
"C:\Users\Admin\AppData\Local\Temp\drop1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4280
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4952
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:936
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3956
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4232
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4108
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4736
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4904
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5112
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4160
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:392
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2484
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4956
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1968
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4436
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:968
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4000
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4680
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4408
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4980
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1392
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3188
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4480
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4704
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1592
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3992
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3312
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4908
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1036
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1948
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4240
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5108
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1588
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2016
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:384
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:636
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3024
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2052
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4696
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2720
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1316
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1292
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5072
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4496
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2456
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:512
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1004
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2672
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3448
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1784
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3632
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3612
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2988
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1296
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1128
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3104
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1192
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1416
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2216
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4080
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2416
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2220
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2224
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1020
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4116
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4224
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4472
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4344
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3704
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4364
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1268
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5080
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3208
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:668
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2528
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2792
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:664
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1124
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4432
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2412
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4064
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1804
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:888
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4788
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4920
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1716
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4784
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3616
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3780
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1120
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4348
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1928
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1628
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4352
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2520
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4304
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4368
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3696
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1868
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3400
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4844
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4092
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1184
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3048
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:996
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2964
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2408
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:640
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2560
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4652
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1440
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4876
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:3860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:880
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4856
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2172
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5124
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5132
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5140
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5148
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5156
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5164
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5172
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5180
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5188
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5220
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5228
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5236
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5260
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5268
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5276
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5284
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5292
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5308
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5316
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5324
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5332
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5340
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5348
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5364
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5372
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5380
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5404
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5412
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5428
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5444
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5468
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5476
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5484
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5492
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5500
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5508
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5524
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5532
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5556
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5564
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5572
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5580
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5588
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5596
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5604
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5612
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5628
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5636
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5644
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5652
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5660
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5668
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5676
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5684
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5700
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5708
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5716
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5740
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5748
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5764
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5772
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5780
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5788
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5804
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5820
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5836
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5844
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5868
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5876
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5884
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5892
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5900
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5908
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5924
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5932
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5940
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5948
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5956
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5964
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5972
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5980
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5988
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:5996
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6004
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6012
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6020
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6028
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6036
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6044
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6052
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6068
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6076
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6084
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6092
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6100
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6108
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6116
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6124
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6132
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6140
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6152
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6160
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6168
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6176
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6184
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6192
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6200
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6208
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6216
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6224
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6232
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6240
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6248
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6256
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6264
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6272
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6280
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6288
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6296
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6304
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6312
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6320
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6328
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6336
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6344
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6352
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6360
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6368
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6376
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6384
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6392
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6400
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6408
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6416
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6424
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6432
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6440
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6448
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6456
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6464
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6472
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6480
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6488
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6496
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6504
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6512
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6520
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6528
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6536
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6544
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6552
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6560
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6568
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6576
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6584
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6592
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6600
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6608
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6616
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6624
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6632
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6640
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6648
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6656
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6664
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6672
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6680
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6688
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6696
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6704
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6712
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6720
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6728
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6736
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6744
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6752
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6760
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6776
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6784
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6792
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6800
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6808
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6824
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6832
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6840
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6848
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6856
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6864
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6872
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6880
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6888
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6896
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6904
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6912
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6920
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6928
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6936
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6944
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6952
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6960
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6968
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6976
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6984
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:6992
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7000
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7008
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7016
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7024
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7040
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7048
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7056
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7064
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7072
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7080
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7088
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7096
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7104
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7112
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7120
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7128
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7136
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7144
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7152
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7160
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2704
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2700
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7172
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7180
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7188
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7220
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7228
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7236
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7260
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7268
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7276
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7284
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7292
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7308
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7316
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7324
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7332
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7340
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7348
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7364
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7372
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7380
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7404
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7412
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7428
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7436
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7444
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7468
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7476
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7484
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7492
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7500
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7508
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7524
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7532
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7556
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7564
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7572
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7580
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7588
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7596
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7604
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7612
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7628
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7636
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7644
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7652
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7660
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7668
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7676
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7684
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7700
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7708
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7716
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7740
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7748
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7764
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7772
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7780
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7788
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7804
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7820
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7836
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7844
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7868
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7876
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7884
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7892
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7900
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7908
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7924
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7932
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7940
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7948
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7956
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7964
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7972
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7980
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7988
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:7996
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8004
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8012
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8020
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8028
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8036
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8044
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8052
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8068
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8076
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8084
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8092
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8100
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8108
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8116
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8124
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8132
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8140
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8148
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8156
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8164
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8172
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8180
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8188
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8220
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8228
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8236
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8260
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8268
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8276
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8284
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8292
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8308
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8316
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8324
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8332
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8340
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8348
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8364
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8372
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8380
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8404
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8412
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8428
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8436
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8444
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8468
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8476
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8484
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8492
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8500
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8508
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8524
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8532
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8556
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8564
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8572
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8580
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8588
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8596
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8604
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8612
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8628
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8636
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8644
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8652
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8660
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8668
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8676
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8684
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8700
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8708
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8716
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8740
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8748
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8764
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8772
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8780
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8788
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8804
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8820
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8836
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8844
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8868
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8876
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8884
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8892
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8900
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8908
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8920
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8928
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8936
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8944
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8952
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8960
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8968
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8976
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8984
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:8992
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9000
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9008
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9016
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9024
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9040
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9048
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9056
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9064
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9072
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9080
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9088
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9096
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9104
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9112
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9120
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9128
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9136
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9144
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9152
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9160
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9168
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9176
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9184
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9192
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9200
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9208
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:1556
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9224
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9232
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9240
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9248
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9256
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9264
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9272
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9280
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9288
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9296
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9304
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9312
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9320
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9328
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9336
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9344
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9352
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9360
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9368
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9376
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9384
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9392
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9400
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9408
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9416
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9424
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9432
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9440
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9448
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9456
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9464
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9472
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9480
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9488
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9496
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9504
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9512
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9520
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9528
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9536
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9544
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9552
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9560
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9568
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9576
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9584
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9592
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9600
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9608
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9616
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9624
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9632
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9640
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9648
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9656
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9664
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9672
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9680
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9688
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9696
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9704
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9712
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9720
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9728
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9736
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9744
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9752
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9760
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9768
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9776
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9784
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9792
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9800
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9808
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9816
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9824
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9832
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9840
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9848
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9856
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9864
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9872
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9880
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9888
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9896
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9904
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9912
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9920
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9928
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9936
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9944
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9952
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9960
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9968
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9976
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9984
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:9992
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10000
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10008
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10016
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10024
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10032
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10040
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10048
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10056
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10064
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10072
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10080
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10088
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10096
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10104
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10112
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10120
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10128
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10136
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10144
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10152
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10160
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10168
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10176
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10184
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10192
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10200
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10208
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10216
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10224
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10232
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:4216
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:2596
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10260
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10268
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10276
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10284
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10292
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10300
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10308
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10316
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10324
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10332
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10340
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10348
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10356
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10364
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10372
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10380
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10388
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10396
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10404
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10412
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10420
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10428
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10436
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10444
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10452
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10460
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10468
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10476
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10484
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10492
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10500
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10508
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10516
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10524
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10532
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10540
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10548
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10556
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10564
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10572
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10580
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10588
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10596
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10604
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10612
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10620
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10628
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10636
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10644
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10652
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10660
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10668
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10676
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10684
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10692
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10700
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10708
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10716
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10724
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10732
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10740
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10748
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10756
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10764
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10772
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10780
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10788
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10796
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10804
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10812
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10820
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10828
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10836
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10844
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10852
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10860
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10868
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10876
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10884
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10892
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10900
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10908
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10916
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10924
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10932
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10940
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10948
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10956
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10964
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10972
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10980
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10988
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:10996
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11004
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11012
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11020
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11028
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11036
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11044
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11052
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11060
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11068
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11076
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11084
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11092
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11100
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11108
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11116
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11124
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11132
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11140
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11148
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11156
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11164
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11172
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11180
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11188
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11196
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11204
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11212
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11220
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11228
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11236
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11244
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11252
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11260
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11272
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11280
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11288
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11296
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11304
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11312
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11320
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11328
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11336
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11344
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11352
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11360
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11368
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11376
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11384
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11392
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11400
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11408
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11416
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11424
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11432
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11440
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11448
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11456
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11464
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11472
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11480
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11488
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11496
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11504
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11512
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11520
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11528
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11536
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11544
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11552
- C:\Users\Admin\AppData\Local\Temp\drop1.exe
  "C:\Users\Admin\AppData\Local\Temp\drop1.exe"
  2⤵
  PID:11560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2468-0-0x0000000000545000-0x0000000000546000-memory.dmp

Filesize
4KB

Download
memory/2468-1-0x0000000000545000-0x0000000000546000-memory.dmp

Filesize
4KB

Download
memory/319224-3-0x0000000000520000-0x000000000078F000-memory.dmp

Filesize
2.4MB

Download