77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c

Analysis

user interaction
yes
max time kernel
5s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Size 267KB
Sample260809-tb9lbabb89
SHA256 77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c
MD5 ebbd61a0c8129b405807f15007a56c3d
SHA1 ad7003c711555e6af70073c2d64fa6631c2b6d37
SHA512 926db78584d9b22274ac82b36e1b3faa1919f8b99f62161a2338bb15d75fca147d84706abd818855ec8fd87ae3befb0a6d2e90f78ab158a53787d448179dbb85
SSDEEP 6144:R2wx/2X9U7kOehxZuE+GgQzSDa0tIWWfcjmrFD3pbW:z0X5Oeh+Ggcnqmld
TLSH
T12C44227B487847DFD17181BBC672B2C53D84BC6D8537342B56853BA82A2CD09A26CCBD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 8 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	DB7.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	AA9.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	422.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	2AB.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	6A2.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	589.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	7FA.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	932.tmp

Executes dropped EXE 13 IoCs

pid	Process
4552	2AB.tmp
4728	422.tmp
2056	589.tmp
2708	6A2.tmp
4872	7FA.tmp
4860	932.tmp
3792	AA9.tmp
4800	C11.tmp
4372	DB7.tmp
6032	F1E.tmp
2928	1095.tmp
4992	11FC.tmp
692	14EA.tmp

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DB7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2AB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AA9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C11.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11FC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	589.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	932.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1095.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	14EA.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	422.tmp

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4728	422.tmp
Token: SeIncBasePriorityPrivilege	4552	2AB.tmp
Token: SeIncBasePriorityPrivilege	2708	6A2.tmp
Token: SeIncBasePriorityPrivilege	2056	589.tmp
Token: SeIncBasePriorityPrivilege	4872	7FA.tmp
Token: SeIncBasePriorityPrivilege	4860	932.tmp
Token: SeIncBasePriorityPrivilege	4372	DB7.tmp

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4784	4632	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	85
PID 4632 wrote to memory of 4552	4632	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	86
PID 4784 wrote to memory of 2500	4784	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	87
PID 4784 wrote to memory of 4728	4784	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	88
PID 2500 wrote to memory of 4964	2500	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	89
PID 2500 wrote to memory of 2056	2500	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	90
PID 4964 wrote to memory of 1088	4964	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	91
PID 4964 wrote to memory of 2708	4964	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	92
PID 1088 wrote to memory of 3452	1088	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	93
PID 1088 wrote to memory of 4872	1088	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	94
PID 3452 wrote to memory of 1756	3452	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	95
PID 3452 wrote to memory of 4860	3452	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	96
PID 1756 wrote to memory of 4856	1756	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	97
PID 1756 wrote to memory of 3792	1756	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	98
PID 4856 wrote to memory of 3980	4856	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	99
PID 4856 wrote to memory of 4800	4856	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	100
PID 4728 wrote to memory of 4920	4728	422.tmp	101
PID 3980 wrote to memory of 2484	3980	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	102
PID 4552 wrote to memory of 3612	4552	2AB.tmp	103
PID 2708 wrote to memory of 904	2708	6A2.tmp	104
PID 3980 wrote to memory of 4372	3980	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	105
PID 2056 wrote to memory of 4296	2056	589.tmp	106
PID 2484 wrote to memory of 3308	2484	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	107
PID 2484 wrote to memory of 6032	2484	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	108
PID 4872 wrote to memory of 5964	4872	7FA.tmp	109
PID 3308 wrote to memory of 1132	3308	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	110
PID 4860 wrote to memory of 2408	4860	932.tmp	111
PID 3308 wrote to memory of 2928	3308	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	112
PID 1132 wrote to memory of 2616	1132	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	113
PID 1132 wrote to memory of 4992	1132	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	114
PID 2616 wrote to memory of 416	2616	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	115
PID 2616 wrote to memory of 692	2616	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	116
PID 4372 wrote to memory of 1636	4372	DB7.tmp	117
PID 416 wrote to memory of 1412	416	77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe	118

C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
"C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
  "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
    "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
      "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1088
      - C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        8⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        9⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3980
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        10⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        11⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        12⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        13⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        14⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:416
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        15⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        16⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        17⤵
        
        PID:728
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        18⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        19⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        20⤵
        
        PID:2632
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        21⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        22⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        23⤵
        
        PID:3092
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        24⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        25⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        26⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        27⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        28⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        29⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        30⤵
        
        PID:5104
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        31⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        32⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        33⤵
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        34⤵
        
        PID:3028
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        35⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        36⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        37⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        38⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        39⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        40⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        41⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        42⤵
        
        PID:3828
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        43⤵
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        44⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        45⤵
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        46⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        47⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        48⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        49⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        50⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        51⤵
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        52⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        53⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        54⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        55⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        56⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        57⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        58⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        59⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        60⤵
        
        PID:2896
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        61⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        62⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        63⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        64⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        65⤵
        
        PID:4492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        66⤵
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        67⤵
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        68⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        69⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        70⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        71⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        72⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        73⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        74⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        75⤵
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        76⤵
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        77⤵
        
        PID:4668
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        78⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        79⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        80⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        81⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        82⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        83⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        84⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        85⤵
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        86⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        87⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        88⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        89⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        90⤵
        
        PID:2520
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        91⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        92⤵
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        93⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        94⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        95⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        96⤵
        
        PID:2676
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        97⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        98⤵
        
        PID:1728
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        99⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        100⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        101⤵
        
        PID:240
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        102⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        103⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        104⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        105⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        106⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        107⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        108⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        109⤵
        
        PID:4768
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        110⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        111⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        112⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        113⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        114⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        115⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        116⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        117⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        118⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        119⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        120⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        121⤵
        
        PID:1768
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        122⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        123⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        124⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        125⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        126⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        127⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        128⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        129⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        130⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        131⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        132⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        133⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        134⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        135⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        136⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        137⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        138⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        139⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        140⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        141⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        142⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        143⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        144⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        145⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        146⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        147⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        148⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        149⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        150⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        151⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        152⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        153⤵
        
        PID:868
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        154⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        155⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        156⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        157⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        158⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        159⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        160⤵
        
        PID:4664
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        161⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        162⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        163⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        164⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        165⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        166⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        167⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        168⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        169⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        170⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        171⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        172⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe
        
        "C:\Users\Admin\AppData\Local\Temp\77d507efbd7b691c3f5d25a970b23fddcca27cb8add487fabac7cbb44a60ba7c.exe"
        173⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\F45E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F45E.tmp"
        173⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\F298.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F298.tmp"
        172⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\F170.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F170.tmp"
        171⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\EFD9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EFD9.tmp"
        170⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\EE72.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EE72.tmp"
        169⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\ED49.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ED49.tmp"
        168⤵
        
        PID:7344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ED49.tmp > nul
        169⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\EBF1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EBF1.tmp"
        167⤵
        
        PID:7176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EBF1.tmp > nul
        168⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\EA7A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\EA7A.tmp"
        166⤵
        
        PID:6616
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EA7A.tmp > nul
        167⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\E961.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E961.tmp"
        165⤵
        
        PID:7152
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E961.tmp > nul
        166⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\E7DA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E7DA.tmp"
        164⤵
        
        PID:2576
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E7DA.tmp > nul
        165⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\E615.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E615.tmp"
        163⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E615.tmp > nul
        164⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\E4EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E4EC.tmp"
        162⤵
        
        PID:6872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E4EC.tmp > nul
        163⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\E356.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E356.tmp"
        161⤵
        
        PID:4764
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E356.tmp > nul
        162⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\E1B0.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E1B0.tmp"
        160⤵
        
        PID:1296
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E1B0.tmp > nul
        161⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\E049.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\E049.tmp"
        159⤵
        
        PID:6988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\E049.tmp > nul
        160⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\DF20.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DF20.tmp"
        158⤵
        
        PID:6412
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DF20.tmp > nul
        159⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\DD8A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DD8A.tmp"
        157⤵
        
        PID:6772
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DD8A.tmp > nul
        158⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\DC61.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DC61.tmp"
        156⤵
        
        PID:6212
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DC61.tmp > nul
        157⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\DABB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DABB.tmp"
        155⤵
        
        PID:4624
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DABB.tmp > nul
        156⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\D992.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D992.tmp"
        154⤵
        
        PID:7148
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D992.tmp > nul
        155⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\D85A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D85A.tmp"
        153⤵
        
        PID:7084
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D85A.tmp > nul
        154⤵
        
        PID:3096
        
        C:\Users\Admin\AppData\Local\Temp\D721.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D721.tmp"
        152⤵
        
        PID:6396
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D721.tmp > nul
        153⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\D5C9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D5C9.tmp"
        151⤵
        
        PID:6732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D5C9.tmp > nul
        152⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\D491.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D491.tmp"
        150⤵
        
        PID:1836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D491.tmp > nul
        151⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\D358.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D358.tmp"
        149⤵
        
        PID:2476
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D358.tmp > nul
        150⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\D201.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D201.tmp"
        148⤵
        
        PID:1352
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D201.tmp > nul
        149⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\D07A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\D07A.tmp"
        147⤵
        
        PID:6284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\D07A.tmp > nul
        148⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\CF32.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CF32.tmp"
        146⤵
        
        PID:6444
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CF32.tmp > nul
        147⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\CE09.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CE09.tmp"
        145⤵
        
        PID:7004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CE09.tmp > nul
        146⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\CC82.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CC82.tmp"
        144⤵
        
        PID:7144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CC82.tmp > nul
        145⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\CB4A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\CB4A.tmp"
        143⤵
        
        PID:5376
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\CB4A.tmp > nul
        144⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\C9D3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C9D3.tmp"
        142⤵
        
        PID:1416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C9D3.tmp > nul
        143⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\C87B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C87B.tmp"
        141⤵
        
        PID:5724
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C87B.tmp > nul
        142⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\C723.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C723.tmp"
        140⤵
        
        PID:5728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C723.tmp > nul
        141⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\C5CC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C5CC.tmp"
        139⤵
        
        PID:6848
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C5CC.tmp > nul
        140⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\C4A3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C4A3.tmp"
        138⤵
        
        PID:4016
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C4A3.tmp > nul
        139⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\C34B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C34B.tmp"
        137⤵
        
        PID:6888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C34B.tmp > nul
        138⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\C222.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C222.tmp"
        136⤵
        
        PID:780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C222.tmp > nul
        137⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\C0CA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C0CA.tmp"
        135⤵
        
        PID:3728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C0CA.tmp > nul
        136⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\BF53.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BF53.tmp"
        134⤵
        
        PID:6404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BF53.tmp > nul
        135⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\BDFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BDFC.tmp"
        133⤵
        
        PID:6692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BDFC.tmp > nul
        134⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\BCE2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BCE2.tmp"
        132⤵
        
        PID:6572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BCE2.tmp > nul
        133⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\BB6B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\BB6B.tmp"
        131⤵
        
        PID:6584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\BB6B.tmp > nul
        132⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\B9D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B9D5.tmp"
        130⤵
        
        PID:6608
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B9D5.tmp > nul
        131⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\B88D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B88D.tmp"
        129⤵
        
        PID:5688
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B88D.tmp > nul
        130⤵
        
        PID:3260
        
        C:\Users\Admin\AppData\Local\Temp\B6F7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B6F7.tmp"
        128⤵
        
        PID:6976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B6F7.tmp > nul
        129⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\B59F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B59F.tmp"
        127⤵
        
        PID:7088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B59F.tmp > nul
        128⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\B457.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B457.tmp"
        126⤵
        
        PID:7020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B457.tmp > nul
        127⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\B32E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B32E.tmp"
        125⤵
        
        PID:6832
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B32E.tmp > nul
        126⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\B1E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B1E6.tmp"
        124⤵
        
        PID:6600
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B1E6.tmp > nul
        125⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\B09E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\B09E.tmp"
        123⤵
        
        PID:6400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\B09E.tmp > nul
        124⤵
        
        PID:2456
        
        C:\Users\Admin\AppData\Local\Temp\AF46.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AF46.tmp"
        122⤵
        
        PID:6248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AF46.tmp > nul
        123⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\ADDF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\ADDF.tmp"
        121⤵
        
        PID:3908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\ADDF.tmp > nul
        122⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\AC58.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AC58.tmp"
        120⤵
        
        PID:1548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AC58.tmp > nul
        121⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\AAD1.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AAD1.tmp"
        119⤵
        
        PID:3536
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AAD1.tmp > nul
        120⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\A999.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A999.tmp"
        118⤵
        
        PID:6160
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A999.tmp > nul
        119⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\A851.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A851.tmp"
        117⤵
        
        PID:7116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A851.tmp > nul
        118⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\A6F9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A6F9.tmp"
        116⤵
        
        PID:6972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A6F9.tmp > nul
        117⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\A572.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A572.tmp"
        115⤵
        
        PID:6836
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A572.tmp > nul
        116⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\A478.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A478.tmp"
        114⤵
        
        PID:6720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A478.tmp > nul
        115⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\A2E2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A2E2.tmp"
        113⤵
        
        PID:6564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A2E2.tmp > nul
        114⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\A15C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\A15C.tmp"
        112⤵
        
        PID:6380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A15C.tmp > nul
        113⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\9FE5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9FE5.tmp"
        111⤵
        
        PID:6224
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9FE5.tmp > nul
        112⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\9E6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9E6E.tmp"
        110⤵
        
        PID:6080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9E6E.tmp > nul
        111⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\9D45.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9D45.tmp"
        109⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9D45.tmp > nul
        110⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\9C0C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9C0C.tmp"
        108⤵
        
        PID:3100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9C0C.tmp > nul
        109⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\9AB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9AB4.tmp"
        107⤵
        
        PID:4748
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9AB4.tmp > nul
        108⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\994D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\994D.tmp"
        106⤵
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\994D.tmp > nul
        107⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\97E6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\97E6.tmp"
        105⤵
        
        PID:4176
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\97E6.tmp > nul
        106⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\96DC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\96DC.tmp"
        104⤵
        
        PID:1528
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\96DC.tmp > nul
        105⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\95A4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\95A4.tmp"
        103⤵
        
        PID:6088
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\95A4.tmp > nul
        104⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\949A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\949A.tmp"
        102⤵
        
        PID:2228
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\949A.tmp > nul
        103⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Local\Temp\9323.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9323.tmp"
        101⤵
        
        PID:1404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9323.tmp > nul
        102⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\916D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\916D.tmp"
        100⤵
        
        PID:2236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\916D.tmp > nul
        101⤵
        
        PID:976
        
        C:\Users\Admin\AppData\Local\Temp\9035.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\9035.tmp"
        99⤵
        
        PID:3708
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9035.tmp > nul
        100⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\8E9F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8E9F.tmp"
        98⤵
        
        PID:4500
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8E9F.tmp > nul
        99⤵
        
        PID:3832
        
        C:\Users\Admin\AppData\Local\Temp\8DA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8DA5.tmp"
        97⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8DA5.tmp > nul
        98⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\8BEF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8BEF.tmp"
        96⤵
        
        PID:1740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8BEF.tmp > nul
        97⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\8AC6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8AC6.tmp"
        95⤵
        
        PID:4780
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8AC6.tmp > nul
        96⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\896F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\896F.tmp"
        94⤵
        
        PID:5920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\896F.tmp > nul
        95⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\8817.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8817.tmp"
        93⤵
        
        PID:5956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8817.tmp > nul
        94⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\86DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\86DE.tmp"
        92⤵
        
        PID:4788
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\86DE.tmp > nul
        93⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\8577.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8577.tmp"
        91⤵
        
        PID:3032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8577.tmp > nul
        92⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\844E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\844E.tmp"
        90⤵
        
        PID:1660
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\844E.tmp > nul
        91⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\8325.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\8325.tmp"
        89⤵
        
        PID:4480
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\8325.tmp > nul
        90⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\822B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\822B.tmp"
        88⤵
        
        PID:3920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\822B.tmp > nul
        89⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Local\Temp\80E3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\80E3.tmp"
        87⤵
        
        PID:3408
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\80E3.tmp > nul
        88⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\7F8B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7F8B.tmp"
        86⤵
        
        PID:4080
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7F8B.tmp > nul
        87⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\7E24.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7E24.tmp"
        85⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7E24.tmp > nul
        86⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\7C6E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7C6E.tmp"
        84⤵
        
        PID:1988
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7C6E.tmp > nul
        85⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\7B55.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7B55.tmp"
        83⤵
        
        PID:3808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7B55.tmp > nul
        84⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\7A2C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7A2C.tmp"
        82⤵
        
        PID:5716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7A2C.tmp > nul
        83⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\78C5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\78C5.tmp"
        81⤵
        
        PID:1840
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\78C5.tmp > nul
        82⤵
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\775E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\775E.tmp"
        80⤵
        
        PID:2860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\775E.tmp > nul
        81⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\75C7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\75C7.tmp"
        79⤵
        
        PID:3796
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\75C7.tmp > nul
        80⤵
        
        PID:4756
        
        C:\Users\Admin\AppData\Local\Temp\74AE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\74AE.tmp"
        78⤵
        
        PID:5220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\74AE.tmp > nul
        79⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\7385.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7385.tmp"
        77⤵
        
        PID:1192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7385.tmp > nul
        78⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\721E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\721E.tmp"
        76⤵
        
        PID:3680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\721E.tmp > nul
        77⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\70C6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\70C6.tmp"
        75⤵
        
        PID:4108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\70C6.tmp > nul
        76⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\6F9D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6F9D.tmp"
        74⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6F9D.tmp > nul
        75⤵
        
        PID:3248
        
        C:\Users\Admin\AppData\Local\Temp\6E36.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6E36.tmp"
        73⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6E36.tmp > nul
        74⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\6CFD.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6CFD.tmp"
        72⤵
        
        PID:2960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6CFD.tmp > nul
        73⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\6BC5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6BC5.tmp"
        71⤵
        
        PID:5960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6BC5.tmp > nul
        72⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\6A7D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A7D.tmp"
        70⤵
        
        PID:5776
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6A7D.tmp > nul
        71⤵
        
        PID:3936
        
        C:\Users\Admin\AppData\Local\Temp\68F6.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\68F6.tmp"
        69⤵
        
        PID:3524
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\68F6.tmp > nul
        70⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\67EC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\67EC.tmp"
        68⤵
        
        PID:4592
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\67EC.tmp > nul
        69⤵
        
        PID:964
        
        C:\Users\Admin\AppData\Local\Temp\6656.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6656.tmp"
        67⤵
        
        PID:1020
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6656.tmp > nul
        68⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\64DF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\64DF.tmp"
        66⤵
        
        PID:2612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\64DF.tmp > nul
        67⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\6397.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6397.tmp"
        65⤵
        
        PID:4824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6397.tmp > nul
        66⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\6220.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6220.tmp"
        64⤵
        
        PID:1612
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6220.tmp > nul
        65⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\603C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\603C.tmp"
        63⤵
        
        PID:1564
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\603C.tmp > nul
        64⤵
        
        PID:2100
        
        C:\Users\Admin\AppData\Local\Temp\5EF4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5EF4.tmp"
        62⤵
        
        PID:3916
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5EF4.tmp > nul
        63⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\5D4E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5D4E.tmp"
        61⤵
        
        PID:972
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5D4E.tmp > nul
        62⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\5A8F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5A8F.tmp"
        60⤵
        
        PID:5164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5A8F.tmp > nul
        61⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\584C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\584C.tmp"
        59⤵
        
        PID:5256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\584C.tmp > nul
        60⤵
        
        PID:1040
        
        C:\Users\Admin\AppData\Local\Temp\56D5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\56D5.tmp"
        58⤵
        
        PID:3268
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\56D5.tmp > nul
        59⤵
        
        PID:3472
        
        C:\Users\Admin\AppData\Local\Temp\5501.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5501.tmp"
        57⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5501.tmp > nul
        58⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\5203.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\5203.tmp"
        56⤵
        
        PID:4976
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5203.tmp > nul
        57⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\4F63.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4F63.tmp"
        55⤵
        
        PID:5656
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4F63.tmp > nul
        56⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\4DFC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4DFC.tmp"
        54⤵
        
        PID:4548
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4DFC.tmp > nul
        55⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\4CB4.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4CB4.tmp"
        53⤵
        
        PID:2756
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4CB4.tmp > nul
        54⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\4B1D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4B1D.tmp"
        52⤵
        
        PID:4028
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4B1D.tmp > nul
        53⤵
        
        PID:560
        
        C:\Users\Admin\AppData\Local\Temp\4997.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4997.tmp"
        51⤵
        
        PID:808
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4997.tmp > nul
        52⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\483F.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\483F.tmp"
        50⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\483F.tmp > nul
        51⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\46A9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\46A9.tmp"
        49⤵
        
        PID:5288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\46A9.tmp > nul
        50⤵
        
        PID:1116
        
        C:\Users\Admin\AppData\Local\Temp\4522.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4522.tmp"
        48⤵
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4522.tmp > nul
        49⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\439C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\439C.tmp"
        47⤵
        
        PID:3380
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\439C.tmp > nul
        48⤵
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\4273.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\4273.tmp"
        46⤵
        
        PID:2108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\4273.tmp > nul
        47⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\410B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\410B.tmp"
        45⤵
        
        PID:3180
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\410B.tmp > nul
        46⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\3F94.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3F94.tmp"
        44⤵
        
        PID:5044
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3F94.tmp > nul
        45⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\3E2D.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3E2D.tmp"
        43⤵
        
        PID:3732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3E2D.tmp > nul
        44⤵
        
        PID:1384
        
        C:\Users\Admin\AppData\Local\Temp\3D04.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3D04.tmp"
        42⤵
        
        PID:4200
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3D04.tmp > nul
        43⤵
        
        PID:1168
        
        C:\Users\Admin\AppData\Local\Temp\3BBC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3BBC.tmp"
        41⤵
        
        PID:5248
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3BBC.tmp > nul
        42⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\3A35.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3A35.tmp"
        40⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3A35.tmp > nul
        41⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\38DE.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\38DE.tmp"
        39⤵
        
        PID:4100
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\38DE.tmp > nul
        40⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\3776.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3776.tmp"
        38⤵
        
        PID:1504
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3776.tmp > nul
        39⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\363E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\363E.tmp"
        37⤵
        
        PID:5360
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\363E.tmp > nul
        38⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\34A7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\34A7.tmp"
        36⤵
        
        PID:1188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\34A7.tmp > nul
        37⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\3321.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3321.tmp"
        35⤵
        
        PID:2192
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3321.tmp > nul
        36⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\31E8.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\31E8.tmp"
        34⤵
        
        PID:4896
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\31E8.tmp > nul
        35⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\3081.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\3081.tmp"
        33⤵
        
        PID:4816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3081.tmp > nul
        34⤵
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\2F39.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2F39.tmp"
        32⤵
        
        PID:220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2F39.tmp > nul
        33⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\2DC2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2DC2.tmp"
        31⤵
        
        PID:5908
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2DC2.tmp > nul
        32⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\2C4B.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2C4B.tmp"
        30⤵
        
        PID:5300
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2C4B.tmp > nul
        31⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\2AF3.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"
        29⤵
        
        PID:3116
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2AF3.tmp > nul
        30⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\29AB.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\29AB.tmp"
        28⤵
        
        PID:5652
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\29AB.tmp > nul
        29⤵
        
        PID:4776
        
        C:\Users\Admin\AppData\Local\Temp\2805.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2805.tmp"
        27⤵
        
        PID:5316
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2805.tmp > nul
        28⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\269E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\269E.tmp"
        26⤵
        
        PID:3940
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\269E.tmp > nul
        27⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\2536.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2536.tmp"
        25⤵
        
        PID:3740
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2536.tmp > nul
        26⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\23CF.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\23CF.tmp"
        24⤵
        
        PID:3544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\23CF.tmp > nul
        25⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\2229.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2229.tmp"
        23⤵
        
        PID:1960
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2229.tmp > nul
        24⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\2074.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\2074.tmp"
        22⤵
        
        PID:4436
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2074.tmp > nul
        23⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\1F5A.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1F5A.tmp"
        21⤵
        
        PID:4032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1F5A.tmp > nul
        22⤵
        
        PID:4312
        
        C:\Users\Admin\AppData\Local\Temp\1DA5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1DA5.tmp"
        20⤵
        
        PID:5400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1DA5.tmp > nul
        21⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\1C6C.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1C6C.tmp"
        19⤵
        
        PID:2164
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1C6C.tmp > nul
        20⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\1AF5.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1AF5.tmp"
        18⤵
        
        PID:1000
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1AF5.tmp > nul
        19⤵
        
        PID:4720
        
        C:\Users\Admin\AppData\Local\Temp\1940.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1940.tmp"
        17⤵
        
        PID:4948
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1940.tmp > nul
        18⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\17B9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\17B9.tmp"
        16⤵
        
        PID:3596
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\17B9.tmp > nul
        17⤵
        
        PID:4244
        
        C:\Users\Admin\AppData\Local\Temp\1642.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1642.tmp"
        15⤵
        
        PID:5452
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1642.tmp > nul
        16⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\14EA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\14EA.tmp"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:692
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\14EA.tmp > nul
        15⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\11FC.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\11FC.tmp"
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\11FC.tmp > nul
        14⤵
        
        PID:1812
        
        C:\Users\Admin\AppData\Local\Temp\1095.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\1095.tmp"
        12⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2928
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\1095.tmp > nul
        13⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\F1E.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\F1E.tmp"
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\F1E.tmp > nul
        12⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\DB7.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\DB7.tmp"
        10⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4372
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\DB7.tmp > nul
        11⤵
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\C11.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\C11.tmp"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4800
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\C11.tmp > nul
        10⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\AA9.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\AA9.tmp"
        8⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3792
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\AA9.tmp > nul
        9⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\932.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\932.tmp"
        7⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4860
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\932.tmp > nul
        8⤵
        
        PID:2408
      - C:\Users\Admin\AppData\Local\Temp\7FA.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\7FA.tmp"
        6⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4872
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\7FA.tmp > nul
        7⤵
        
        PID:5964
    - - C:\Users\Admin\AppData\Local\Temp\6A2.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\6A2.tmp"
        5⤵
        Checks computer location settings
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2708
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\6A2.tmp > nul
        6⤵
        
        PID:904
  - - C:\Users\Admin\AppData\Local\Temp\589.tmp
      "C:\Users\Admin\AppData\Local\Temp\589.tmp"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\589.tmp > nul
        5⤵
        
        PID:4296
- - C:\Users\Admin\AppData\Local\Temp\422.tmp
    "C:\Users\Admin\AppData\Local\Temp\422.tmp"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4728
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\422.tmp > nul
      4⤵
      PID:4920
- C:\Users\Admin\AppData\Local\Temp\2AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\2AB.tmp"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\2AB.tmp > nul
    3⤵
    PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\2AB.tmp
Size 9KB
SHA256 39dbd9bad495d47192f71767003b85fc128f41e078eeb155ae476d5c16623b7a
MD5 8067e337d956b982349ae09accafa9db
SHA1 bd608f264b8a71ed6b333398b4e1184bd5662f6b
SHA512 185c78327d210de8429e66c5315c9115b9c398671bd1cd2029153dd0f11f004adb800e04a45960251fdb38957b42400a800f1d667a769a59e0d201f1f3ae3069
SSDEEP 192:w0j+VHWCT2XzxsPxEI7N3zTleB+111YhxVzAGA01:hKgCTctsPxjFkIxYhwZ
TLSH
T14F127D5E225C9479C49C0EF60E6781E65EB03362C27E623C40C7C2DE87EAE67512F751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4552-3-0x0000000000530000-0x0000000000531000-memory.dmp

Download

memory/4632-0-0x00000000005A0000-0x00000000005E2000-memory.dmp

Download

memory/4632-2-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/4728-16-0x0000000000400000-0x000000000040A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads