njrat | 3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8

Analysis

max time kernel
492s
max time network
822s
platform
windows11-21h2_x64
resource
win11-20250314-en
resource tags

arch:x64arch:x86image:win11-20250314-enlocale:en-usos:windows11-21h2-x64system
submitted
21/03/2025, 20:30

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

pisun.exe
Size

54KB
MD5

45140e967970cd63521eaa76dc4db7d7
SHA1

aae8aa4c5fb8e1d5a830f1f095d7550a89b7634a
SHA256

3990ab6d73f0a92606cb4c86d39e077f014da65413a264be94d03ca8478e64b8
SHA512

d8c5274fc1c66700c3fb63527973cb20106070698eebdf90e6b3f9ace371e34a653e382f949683d9aab0cb33fdd00ab2b943e499a4d2d6f42a24822fa2142129
SSDEEP

768:U8I0g652Esltuq55JR2ET3NwJSNbxWQG35bmaePD5PvXOC2XXJdxIEpmvg:U8ZVGtZ5DTCGlWQcGD0LX3xIEpmvg

Score

10^/10

njrat bootkit defense_evasion discovery persistence trojan upx

Malware Config

Signatures

Njrat family
njrat
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Disables RegEdit via registry modification 1 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3920535620-1286624088-2946613906-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	18c31be6d84a42268d1776ee1eba501c.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 25 IoCs

pid	Process
3084	18c31be6d84a42268d1776ee1eba501c.exe
3644	24e102d705cc4817b6201db7b69ed8e0.exe
3844	8bb288deb33043a28e1627f1d690373f.exe
3040	6c814c9adc5c4d81b55d2ec9a4102728.exe
5988	b152d002bc274a318dea6365178dcebb.exe
5412	6f9d64cec3bd4103a925b68e879b97ec.exe
3984	7732eb7cfb8b42738d48e25a165b5d0f.exe
5288	7732eb7cfb8b42738d48e25a165b5d0f.exe
5708	7732eb7cfb8b42738d48e25a165b5d0f.exe
4176	7732eb7cfb8b42738d48e25a165b5d0f.exe
1428	7732eb7cfb8b42738d48e25a165b5d0f.exe
3884	7732eb7cfb8b42738d48e25a165b5d0f.exe
4688	7732eb7cfb8b42738d48e25a165b5d0f.exe
3104	7732eb7cfb8b42738d48e25a165b5d0f.exe
5200	7732eb7cfb8b42738d48e25a165b5d0f.exe
3016	7732eb7cfb8b42738d48e25a165b5d0f.exe
4272	7732eb7cfb8b42738d48e25a165b5d0f.exe
4996	7732eb7cfb8b42738d48e25a165b5d0f.exe
2780	7732eb7cfb8b42738d48e25a165b5d0f.exe
2556	7732eb7cfb8b42738d48e25a165b5d0f.exe
6060	7732eb7cfb8b42738d48e25a165b5d0f.exe
5904	7732eb7cfb8b42738d48e25a165b5d0f.exe
2616	7732eb7cfb8b42738d48e25a165b5d0f.exe
216	7732eb7cfb8b42738d48e25a165b5d0f.exe
4104	7732eb7cfb8b42738d48e25a165b5d0f.exe

Writes to the Master Boot Record (MBR) 1 TTPs 21 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	b152d002bc274a318dea6365178dcebb.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PHYSICALDRIVE0	7732eb7cfb8b42738d48e25a165b5d0f.exe
File opened for modification	\??\PhysicalDrive0	pisun.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x001900000002b210-17.dat	upx
behavioral1/memory/3084-20-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/memory/3084-22-0x0000000000400000-0x000000000040F000-memory.dmp	upx
behavioral1/files/0x000500000000d3d4-210.dat	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Win32.bat	cmd.exe
File opened for modification	C:\Windows\Win32.bat	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5352	5988	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 26 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8bb288deb33043a28e1627f1d690373f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pisun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24e102d705cc4817b6201db7b69ed8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b152d002bc274a318dea6365178dcebb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6f9d64cec3bd4103a925b68e879b97ec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18c31be6d84a42268d1776ee1eba501c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6c814c9adc5c4d81b55d2ec9a4102728.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7732eb7cfb8b42738d48e25a165b5d0f.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
460	taskkill.exe
4148	taskkill.exe
1956	taskkill.exe
3996	taskkill.exe
2888	taskkill.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2324	reg.exe
4640	reg.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5988	b152d002bc274a318dea6365178dcebb.exe
5988	b152d002bc274a318dea6365178dcebb.exe
5988	b152d002bc274a318dea6365178dcebb.exe
5988	b152d002bc274a318dea6365178dcebb.exe
5988	b152d002bc274a318dea6365178dcebb.exe
5988	b152d002bc274a318dea6365178dcebb.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4800	pisun.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4804	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4804	AUDIODG.EXE
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe
Token: SeIncBasePriorityPrivilege	4800	pisun.exe
Token: 33	4800	pisun.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3644	24e102d705cc4817b6201db7b69ed8e0.exe
4800	pisun.exe
4800	pisun.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3844	8bb288deb33043a28e1627f1d690373f.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3084	4800	pisun.exe	80
PID 4800 wrote to memory of 3084	4800	pisun.exe	80
PID 4800 wrote to memory of 3084	4800	pisun.exe	80
PID 4800 wrote to memory of 3644	4800	pisun.exe	81
PID 4800 wrote to memory of 3644	4800	pisun.exe	81
PID 4800 wrote to memory of 3644	4800	pisun.exe	81
PID 4800 wrote to memory of 3844	4800	pisun.exe	82
PID 4800 wrote to memory of 3844	4800	pisun.exe	82
PID 4800 wrote to memory of 3844	4800	pisun.exe	82
PID 4800 wrote to memory of 3040	4800	pisun.exe	83
PID 4800 wrote to memory of 3040	4800	pisun.exe	83
PID 4800 wrote to memory of 3040	4800	pisun.exe	83
PID 4800 wrote to memory of 5988	4800	pisun.exe	87
PID 4800 wrote to memory of 5988	4800	pisun.exe	87
PID 4800 wrote to memory of 5988	4800	pisun.exe	87
PID 4800 wrote to memory of 5412	4800	pisun.exe	91
PID 4800 wrote to memory of 5412	4800	pisun.exe	91
PID 4800 wrote to memory of 5412	4800	pisun.exe	91
PID 5412 wrote to memory of 1612	5412	6f9d64cec3bd4103a925b68e879b97ec.exe	92
PID 5412 wrote to memory of 1612	5412	6f9d64cec3bd4103a925b68e879b97ec.exe	92
PID 1612 wrote to memory of 956	1612	cmd.exe	96
PID 1612 wrote to memory of 956	1612	cmd.exe	96
PID 1612 wrote to memory of 460	1612	cmd.exe	97
PID 1612 wrote to memory of 460	1612	cmd.exe	97
PID 1612 wrote to memory of 4148	1612	cmd.exe	98
PID 1612 wrote to memory of 4148	1612	cmd.exe	98
PID 1612 wrote to memory of 1956	1612	cmd.exe	99
PID 1612 wrote to memory of 1956	1612	cmd.exe	99
PID 1612 wrote to memory of 3996	1612	cmd.exe	100
PID 1612 wrote to memory of 3996	1612	cmd.exe	100
PID 1612 wrote to memory of 2888	1612	cmd.exe	101
PID 1612 wrote to memory of 2888	1612	cmd.exe	101
PID 1612 wrote to memory of 2324	1612	cmd.exe	102
PID 1612 wrote to memory of 2324	1612	cmd.exe	102
PID 1612 wrote to memory of 4640	1612	cmd.exe	103
PID 1612 wrote to memory of 4640	1612	cmd.exe	103
PID 4800 wrote to memory of 3984	4800	pisun.exe	104
PID 4800 wrote to memory of 3984	4800	pisun.exe	104
PID 4800 wrote to memory of 3984	4800	pisun.exe	104
PID 3984 wrote to memory of 5288	3984	7732eb7cfb8b42738d48e25a165b5d0f.exe	105
PID 3984 wrote to memory of 5288	3984	7732eb7cfb8b42738d48e25a165b5d0f.exe	105
PID 3984 wrote to memory of 5288	3984	7732eb7cfb8b42738d48e25a165b5d0f.exe	105
PID 5288 wrote to memory of 5708	5288	7732eb7cfb8b42738d48e25a165b5d0f.exe	106
PID 5288 wrote to memory of 5708	5288	7732eb7cfb8b42738d48e25a165b5d0f.exe	106
PID 5288 wrote to memory of 5708	5288	7732eb7cfb8b42738d48e25a165b5d0f.exe	106
PID 5708 wrote to memory of 4176	5708	7732eb7cfb8b42738d48e25a165b5d0f.exe	107
PID 5708 wrote to memory of 4176	5708	7732eb7cfb8b42738d48e25a165b5d0f.exe	107
PID 5708 wrote to memory of 4176	5708	7732eb7cfb8b42738d48e25a165b5d0f.exe	107
PID 4176 wrote to memory of 1428	4176	7732eb7cfb8b42738d48e25a165b5d0f.exe	108
PID 4176 wrote to memory of 1428	4176	7732eb7cfb8b42738d48e25a165b5d0f.exe	108
PID 4176 wrote to memory of 1428	4176	7732eb7cfb8b42738d48e25a165b5d0f.exe	108
PID 1428 wrote to memory of 3884	1428	7732eb7cfb8b42738d48e25a165b5d0f.exe	109
PID 1428 wrote to memory of 3884	1428	7732eb7cfb8b42738d48e25a165b5d0f.exe	109
PID 1428 wrote to memory of 3884	1428	7732eb7cfb8b42738d48e25a165b5d0f.exe	109
PID 3884 wrote to memory of 4688	3884	7732eb7cfb8b42738d48e25a165b5d0f.exe	110
PID 3884 wrote to memory of 4688	3884	7732eb7cfb8b42738d48e25a165b5d0f.exe	110
PID 3884 wrote to memory of 4688	3884	7732eb7cfb8b42738d48e25a165b5d0f.exe	110
PID 4688 wrote to memory of 3104	4688	7732eb7cfb8b42738d48e25a165b5d0f.exe	111
PID 4688 wrote to memory of 3104	4688	7732eb7cfb8b42738d48e25a165b5d0f.exe	111
PID 4688 wrote to memory of 3104	4688	7732eb7cfb8b42738d48e25a165b5d0f.exe	111
PID 3104 wrote to memory of 5200	3104	7732eb7cfb8b42738d48e25a165b5d0f.exe	112
PID 3104 wrote to memory of 5200	3104	7732eb7cfb8b42738d48e25a165b5d0f.exe	112
PID 3104 wrote to memory of 5200	3104	7732eb7cfb8b42738d48e25a165b5d0f.exe	112
PID 5200 wrote to memory of 3016	5200	7732eb7cfb8b42738d48e25a165b5d0f.exe	113

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	18c31be6d84a42268d1776ee1eba501c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	18c31be6d84a42268d1776ee1eba501c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoViewContextMenu = "1"	18c31be6d84a42268d1776ee1eba501c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoShellSearchButton = "1"	18c31be6d84a42268d1776ee1eba501c.exe

C:\Users\Admin\AppData\Local\Temp\pisun.exe
"C:\Users\Admin\AppData\Local\Temp\pisun.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Users\Admin\AppData\Local\Temp\18c31be6d84a42268d1776ee1eba501c.exe
  "C:\Users\Admin\AppData\Local\Temp\18c31be6d84a42268d1776ee1eba501c.exe"
  2⤵
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:3084
- C:\Users\Admin\AppData\Local\Temp\24e102d705cc4817b6201db7b69ed8e0.exe
  "C:\Users\Admin\AppData\Local\Temp\24e102d705cc4817b6201db7b69ed8e0.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:3644
- C:\Users\Admin\AppData\Local\Temp\8bb288deb33043a28e1627f1d690373f.exe
  "C:\Users\Admin\AppData\Local\Temp\8bb288deb33043a28e1627f1d690373f.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3844
- C:\Users\Admin\AppData\Local\Temp\6c814c9adc5c4d81b55d2ec9a4102728.exe
  "C:\Users\Admin\AppData\Local\Temp\6c814c9adc5c4d81b55d2ec9a4102728.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3040
- C:\Users\Admin\AppData\Local\Temp\b152d002bc274a318dea6365178dcebb.exe
  "C:\Users\Admin\AppData\Local\Temp\b152d002bc274a318dea6365178dcebb.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5988 -s 516
    3⤵
    - Program crash
    PID:5352
- C:\Users\Admin\AppData\Local\Temp\6f9d64cec3bd4103a925b68e879b97ec.exe
  "C:\Users\Admin\AppData\Local\Temp\6f9d64cec3bd4103a925b68e879b97ec.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5412
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\F24D.tmp\F24E.bat C:\Users\Admin\AppData\Local\Temp\6f9d64cec3bd4103a925b68e879b97ec.exe"
    3⤵
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:1612
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v Win32 /t REG_SZ /d C:\Windows\Win32.bat /f
      4⤵
      PID:956
  - - C:\Windows\system32\taskkill.exe
      taskkill /im /f chrome.exe
      4⤵
      Kills process with taskkill
      PID:460
  - - C:\Windows\system32\taskkill.exe
      taskkill /im /f ie.exe
      4⤵
      Kills process with taskkill
      PID:4148
  - - C:\Windows\system32\taskkill.exe
      taskkill /im /f firefox.exe
      4⤵
      Kills process with taskkill
      PID:1956
  - - C:\Windows\system32\taskkill.exe
      taskkill /im /f opera.exe
      4⤵
      Kills process with taskkill
      PID:3996
  - - C:\Windows\system32\taskkill.exe
      taskkill /im /f safari.exe
      4⤵
      Kills process with taskkill
      PID:2888
  - - C:\Windows\system32\reg.exe
      Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot\*.* /q
      4⤵
      Modifies registry key
      PID:2324
  - - C:\Windows\system32\reg.exe
      Reg Delete HKLM\System\CurrentControlSet\Control\SafeBoot /q
      4⤵
      Modifies registry key
      PID:4640
- C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
  "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4176
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3104
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:3016
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:1152
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:23676
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:34188
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:26336
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:38204
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:20800
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:29556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        21⤵
        
        PID:33488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:18836
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:26476
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:22292
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:32316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:34448
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:19012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:27072
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:21372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:31780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        20⤵
        
        PID:32712
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:18548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:26420
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:15864
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:23780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:34400
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:26452
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:21240
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:29616
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:1948
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:20404
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:29336
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:22864
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:33380
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:36780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:20524
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:29468
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:32360
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:18388
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:25704
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:36488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:21744
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:30044
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:34456
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:18996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:27160
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        19⤵
        
        PID:30120
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:25636
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:36872
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:19400
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:27104
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:29592
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:17776
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:25256
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:35928
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:26560
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:20976
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:29640
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:24472
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:34408
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:28052
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:23340
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:33972
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:1824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        18⤵
        
        PID:28068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:20784
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:30060
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:25296
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:36244
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:26952
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:23772
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:34548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:26944
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:20660
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:29868
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:17520
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:25048
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:35876
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:30152
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:24276
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:34144
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:1988
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        17⤵
        
        PID:28104
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:23692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:33396
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:25264
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:36096
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:25936
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:36912
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:23308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:34416
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:26688
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:20968
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:29752
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:25428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:36472
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:27468
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:23276
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:34068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:15856
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:23300
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:34644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:28060
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:23612
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:34244
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:20396
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:29624
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:21568
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:29672
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:35608
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:19020
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27120
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:10764
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:26372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:20776
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:29524
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:25248
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:36008
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27740
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:23324
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:34652
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        16⤵
        
        PID:36772
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:20572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:29772
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:21784
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:30188
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:36796
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:19252
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27364
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:28220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:20984
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:31280
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:19288
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27380
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:30816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:24996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:35892
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:19740
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27412
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:32692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:25380
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:36340
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:24056
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:34812
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:28228
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:20824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:29576
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        15⤵
        
        PID:36156
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:20184
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:28856
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:23196
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:34636
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:36064
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:20540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:29564
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:27788
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:20816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:29648
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:25416
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:36632
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:30692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:23860
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:34208
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:4884
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:24048
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:34320
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:20604
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:29476
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:23244
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:34020
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:23968
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:34128
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:20960
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:29884
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        14⤵
        
        PID:32248
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:18652
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:26436
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:20024
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:28004
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:13080
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:32728
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:18644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:26408
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:24480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:35076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:20652
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:29976
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:17912
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:25388
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:36316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:27060
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:23456
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:34076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:21824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:30212
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:30104
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:17864
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:25224
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:35952
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:24092
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:34392
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:23484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:34100
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:20556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:29372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:21768
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:30236
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:11040
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:25944
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:36904
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:36756
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:20808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:29532
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        13⤵
        
        PID:33536
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:18724
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:26484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:22300
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:32220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:34500
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:19004
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:27096
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:24396
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:34440
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:21232
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:29608
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:25136
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:35944
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:27860
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:15776
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:23252
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:34004
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:2600
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:23376
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:33980
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:28044
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:21536
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:30180
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:34012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19212
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:27112
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:21408
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:30172
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:21752
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:30220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:4232
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:19244
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:27372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:27516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:23400
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:34624
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:36024
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:20032
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:28640
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:22284
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:32308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:36764
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19536
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:27396
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:23016
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:33956
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:20760
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:29516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:8596
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:17628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:25272
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:36308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:26552
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34116
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:33660
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19916
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:28248
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:22856
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:33372
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:14348
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:36812
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:20580
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:29416
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:34476
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:18588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:26296
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:37876
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:21552
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:29812
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:32648
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:18664
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:26468
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:28036
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:21000
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:31492
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:20292
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:29296
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:32824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:17824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:25200
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:36452
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:30076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:20636
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:31484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19236
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:27236
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:27852
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23348
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:33996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:22268
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:32228
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:12428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:32264
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:25364
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23408
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34672
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:28236
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:21120
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:30196
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23384
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34468
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:28084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36640
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:20952
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:32736
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:18708
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:26492
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:21560
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:30808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:33516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19108
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27228
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        12⤵
        
        PID:32832
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:18700
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:26396
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:19296
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:27340
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:32548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:25184
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:36276
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:30936
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:17840
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:25208
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:35908
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19800
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:28012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:12956
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:32236
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:27436
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:23008
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:33964
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:36148
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:20548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:29356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23764
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34196
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:28028
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:38228
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:20628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:31768
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:15872
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23284
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:25816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36936
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:22276
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:32368
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36192
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:19272
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:27136
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:21356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29804
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:33480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19260
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27128
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36072
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:20192
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:28888
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:22260
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:32272
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:33808
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27428
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:30136
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:18136
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:25216
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36444
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19140
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27152
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:32532
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:25240
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:36016
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:4104
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        11⤵
        
        PID:32288
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:18556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:26056
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:37060
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:22816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:33364
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:34484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:26304
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:37884
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:30112
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:20644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:29484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:19556
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:27356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:32656
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:18576
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:26316
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:37796
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:19312
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:27144
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:32208
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:18608
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:26284
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:38084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:23292
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:34612
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:30144
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23476
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34108
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:19904
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:27868
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:28092
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23392
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:33988
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:33948
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19528
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27420
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:21760
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:30244
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:20596
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29492
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:780
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23260
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34056
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:28020
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36800
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:20840
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29500
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:33632
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:18748
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:26544
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19304
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:27388
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29892
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25620
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36880
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:30924
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:17540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:25628
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36896
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:17484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:25084
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36088
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:30068
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:23356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:34432
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:26356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:21224
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:25128
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:36284
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:26680
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23268
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34092
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:21256
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29860
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:30128
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:18328
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:25288
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36292
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23220
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34028
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23080
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34136
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19328
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29344
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:564
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:36788
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:20792
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:29632
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:22044
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:31664
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:35092
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19156
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:27080
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:29984
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:25192
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:36464
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19792
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:27996
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:30580
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25440
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36372
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36184
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19924
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:27892
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:21544
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29900
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:34492
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:18740
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:26504
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:33940
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:18716
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:26388
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:17800
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25396
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36324
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:32720
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:25232
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:36364
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:4480
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:19280
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:27184
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        10⤵
        
        PID:32540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:18540
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:26380
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:21484
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:29956
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:24252
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:34312
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:20532
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29548
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:23000
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:33752
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        9⤵
        
        PID:36820
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:20564
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:29424
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:23668
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:34036
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:28076
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:21128
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:29600
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:19228
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:27088
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:28996
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:16516
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23684
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34052
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:33608
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:19028
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27404
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:26696
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:20588
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29968
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        8⤵
        
        PID:38184
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:21776
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:30504
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:27448
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36856
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:20512
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29364
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:32200
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:18564
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:26444
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:19808
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:27884
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29664
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25716
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36888
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:23168
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:34044
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        7⤵
        
        PID:36200
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:20384
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:29388
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:25076
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:35884
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:30160
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:23920
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:34664
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:28864
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:36176
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:20768
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:29508
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25328
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36236
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:28112
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:23900
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:34180
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:21576
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:30204
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:32588
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:18532
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:25732
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:36480
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        6⤵
        
        PID:33760
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:19544
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:27332
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:22848
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:33388
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:14772
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:20992
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:31060
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
        
        "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
        5⤵
        
        PID:26364
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:21528
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:29792
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:8896
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:19816
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:27876
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
      "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
      4⤵
      PID:30096
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:17856
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:25280
- - C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe
    "C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe"
    3⤵
    PID:36300

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5988 -ip 5988
1⤵
PID:4528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\18c31be6d84a42268d1776ee1eba501c.exe

Filesize
30KB

MD5
c603c9f2b795f4403a3ef90921b6d442

SHA1
5e2536d059ebc67fa0d7efa719d3060903d90311

SHA256
3bd1db009f00810189e035a5c836cf2d0df24007836ad0a912ed4ea9f1789e53

SHA512
21d22954893bb568aca371c469a715aa96a2a59551ba08638bde92ea90e9c8ab692a7f803f2812c195a1359d2cf6b6a9ac4c7bd3cfb6ab180e8726aa690b2c84

Download Submit
C:\Users\Admin\AppData\Local\Temp\24e102d705cc4817b6201db7b69ed8e0.exe

Filesize
239KB

MD5
e27e8287917a663b89681fbb7bccfc95

SHA1
e2771171bd7b4465a651283f9b7c0580d49710d7

SHA256
06ebc30a7b557af2be09c8b626958babd690632e3c7e60b3c2bbe93e5c9c06e4

SHA512
7d4c6f2624db6b16f0176b3db50a4315ea96debfb006aa7b1266f8a21692b5e2488566197852caeae2cf1482558fd898e097d13d9e10794b5441c4dc48a72ae7

Download Submit
C:\Users\Admin\AppData\Local\Temp\3fdfd30155574e90a848d37c4145cbba.exe

Filesize
1.7MB

MD5
6e628c5531010f1053fff090a7699659

SHA1
237e5b8870092dd0e9a3b0fb76da93fcfce56516

SHA256
52d65a486dd027d9d6e3ca10ea808815ff0fda4e5032695333b7c2d5a5f95e41

SHA512
53eb023d70038b2820a6c0ed0a453307f90b22279e521fa8af3b6ef240ce022300a1d05794bf02d52f472c5adeb87c814373c5e29b3f13102c0128af06d5f0e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6c814c9adc5c4d81b55d2ec9a4102728.exe

Filesize
135KB

MD5
c971c68b4e58ccc82802b21ae8488bc7

SHA1
7305f3a0a0a0d489e0bcf664353289f61556de77

SHA256
cede0b15d88c20bc750b516858f8bf31ee472f6cbd01640840890736c4333cce

SHA512
ff199691c35f2748772410bf454e8b76dd67d892dd76fc87d20b3bbe6c145c6af1685344de636326692df792f55d0fba9a0025a7cf491d0b4e73ff45c3b039d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\6f9d64cec3bd4103a925b68e879b97ec.exe

Filesize
69KB

MD5
57aefeb4dc6a62340c9cd1ee49d043d1

SHA1
e769b03d88cc128982f5394c28f6ba31cac957b7

SHA256
6f396703789bb1d26f98023d79f1a634dadc1cd5c2f3c096a42119e022381edd

SHA512
db2a5c757f9d90da18a48cd6fdec120439b1e3ae9552c76d433da890c68cb9ff65f9c35da5f97a4e9bfbda1feb214895e7121fe63dd4318149a6aedf348c2e89

Download Submit
C:\Users\Admin\AppData\Local\Temp\7732eb7cfb8b42738d48e25a165b5d0f.exe

Filesize
10KB

MD5
76386705862925ccbf1e3f711a6e6b56

SHA1
2335fae9eb828b09930a2b01910b1b594395004e

SHA256
a62e7ad75ab140bf45272989ac9b9f5937298c8c5ffdccd19323452c0e793b90

SHA512
893000f32223c67dce85c7a9f0edd315743ce56372557d432a1c6fcb19b728e7110adee7e23f7de7b6ad59f48fe632d27ebafcb0fab00a3ecad01a23c7e6000f

Download Submit
C:\Users\Admin\AppData\Local\Temp\8bb288deb33043a28e1627f1d690373f.exe

Filesize
28KB

MD5
62cbb85434223022a0b0e369b227a3d9

SHA1
4978b691168f16c678a1ffe53e126ba1d946bce0

SHA256
ea3087204e3ed644308a0a96bbf319590a9b2701ac850bb63f2ba3dc4955f1fd

SHA512
f76d281ce4c4401315f811dba1512757fa59a9c1ca6486c006f7861aed793a1f196fd66b772405374a751f383b5a234234e64de16f2fe9d613694e354b882f69

Download Submit
C:\Users\Admin\AppData\Local\Temp\F24D.tmp\F24E.bat

Filesize
1KB

MD5
2854ba232e3a9bd85ebbc306b5fdbb93

SHA1
62f6c8eb5dc94e0a13ca36f880927bfbae826d8a

SHA256
995feb5aabca4e0a431003d2cf0989aafe34afaec0a42c7305d610512c9dc3b5

SHA512
ed9207b247462ef4325fed7a0f2c17263ace7117eea2b40c1ff9a966a4b2c7dcfc8f84d80e81e69e4758f9e0ff9f3f85a4085caa8633d4ad86406896e314073a

Download Submit
C:\Users\Admin\AppData\Local\Temp\b152d002bc274a318dea6365178dcebb.exe

Filesize
47KB

MD5
c61693e8d501dcdbcd2346853a80417a

SHA1
edf5803d2c9cc7807b571d9d081ca06387ee7cd9

SHA256
f0d5399c42971102e56abbcc9efd1d0b104ddb36da5bccd67e18850a1a21fad4

SHA512
8cc0fe94e144e754cf0fd0d4de2f4361adaf7fc83116fc3009272efa6df2eb0c60b04dc037ffde1581906471196ffae0cb51262a7ac731b515ff091a64da41d6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_394E5D754BF4450DA920E9865440C736.dat

Filesize
940B

MD5
352c2d90bad86cd20ddd5c856fa9aa86

SHA1
1763c6fa0b08d5a4c6e85e2cacc9cb76f134721e

SHA256
4fcb7442c541417c4a7e8959e80b0e5288f26acd8db51ef8b9799da3395f47b6

SHA512
14b1c5e6e8e631677d3b03288fcb9bd3829c6d94d8778714c4bc02438df3165d7c59495b98cec1fa2694ba2b89523d52af27c00fe39e2a39b6151aede8e8d604

Download Submit
memory/3084-20-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3084-22-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/3644-75-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3644-34-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3644-188-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3644-35-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3644-36-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/3644-84-0x0000000000400000-0x0000000000441000-memory.dmp

Filesize
260KB

Download
memory/3984-121-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/4800-5-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-3-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-6-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-2-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-4-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-0-0x0000000074701000-0x0000000074702000-memory.dmp

Filesize
4KB

Download
memory/4800-1-0x0000000074700000-0x0000000074CB1000-memory.dmp

Filesize
5.7MB

Download
memory/4996-134-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/5988-124-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/5988-187-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/7504-173-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads